Fix QA review findings: server-side validation, notes encoding, dashboard totals

Validate document lines on the server and recompute their totals, store notes with quotes/markup/emoji (utf8mb4, idempotent escaping, decode in form fields), exclude transfers from company-wide stock in/out, count revenue from confirmed orders only, one low-stock rule everywhere, list unapproved lots, natural bin sort, stable order/PO sort, status tiles that add up.

app/dashboard/api/engine_report/low_stock.php

@@ -14,8 +14,14 @@
         if ($item['status'] === 'critical') { $critical++; } else { $warning++; }
     }
 
+    // Every active warehouse, so one with healthy stock still appears in the
+    // filter (and reads as "nothing low here") instead of looking left out.
+    $sth = $pdo2->prepare("SELECT id, warehouse_name FROM md_warehouse WHERE company_id = :cid AND status = 1 ORDER BY warehouse_name");
+    $sth->execute([':cid' => $company_id]);
+
     $answer['output'] = [
         'items'          => $items,
+        'warehouses'     => $sth->fetchAll(PDO::FETCH_ASSOC),
         'total_low'      => count($items),
         'total_critical' => $critical,
         'total_warning'  => $warning,