Fix QA review findings: server-side validation, notes encoding, dashboard totals

Validate document lines on the server and recompute their totals, store notes with quotes/markup/emoji (utf8mb4, idempotent escaping, decode in form fields), exclude transfers from company-wide stock in/out, count revenue from confirmed orders only, one low-stock rule everywhere, list unapproved lots, natural bin sort, stable order/PO sort, status tiles that add up.

app/reports/expired_stock.php

@@ -306,7 +306,7 @@
         <td class="py-3">${item.product_sku}</td>
         <td class="py-3">${item.lot_number || '<span class="text-muted">—</span>'}</td>
         <td class="py-3">${format_location(item)}</td>
-        <td class="py-3">${item.expiry_date}</td>
+        <td class="py-3">${format_date(item.expiry_date)}</td>
         <td class="py-3 text-danger fw-semibold">${Math.abs(item.days_remaining)} days</td>
         <td class="py-3">${item.quantity}</td>
         <td class="py-3">${status_badge(item.status)}</td>
@@ -330,7 +330,7 @@
         <td class="py-3">${item.product_sku}</td>
         <td class="py-3">${item.lot_number || '<span class="text-muted">—</span>'}</td>
         <td class="py-3">${format_location(item)}</td>
-        <td class="py-3">${item.expiry_date}</td>
+        <td class="py-3">${format_date(item.expiry_date)}</td>
         <td class="py-3 text-warning fw-semibold">${item.days_remaining} days</td>
         <td class="py-3">${item.quantity}</td>
         <td class="py-3">${status_badge(item.status)}</td>