Audit round: safer sessions, money that adds up, no leaks between people

What changed

• Security: invitation and calendar-feed tokens are masked in logs; return paths after sign-in stay inside the app; portal codes cannot be guessed with parallel tries; a security e-mail goes out on an address change and on a sign-in from a new device.
• Money: a case has one accepted quote; refunds and re-collections update commissions correctly; amounts round to the currency's minor unit; erasing a person anonymises the payment ledger instead of deleting it; a cancelled or switched plan no longer gives away a period already started; one trial per person.
• Privacy: patient photos lose their location data on upload; private files are stored under the workspace's own key and their downloads are recorded in the workspace's own log; the GDPR deadline is one calendar month and the KVKK deadline 30 days.
• Correctness: filters and the overview follow the workspace's day; searching people and cases matches Turkish letters; the calendar applies daylight saving time correctly; two simultaneous bookings cannot clash; submitting the same form twice creates one record.
• Sessions: members stay signed in to the app.