refactor: professional code quality audit

- Fix all TypeScript compilation errors (0 errors in src/)
- Add try/catch error handling to ALL API routes (38 handlers)
- Fix empty catch blocks (api-auth.ts now logs warnings)
- Add aria-labels to all icon-only buttons (WCAG 2.1 AA)
- Fix Prisma type mismatches (OR filter, Person.companyId, Estimate.projectId, Ticket.createdAt)
- Fix webhook PATCH route (moved to [id]/route.ts)
- Fix mobile-bottom-nav type safety
- Fix KB route where-clause type
- Fix test-mail banner null vs undefined
- Fix task comment fetch: add cancellation + error toast
- ESLint: 0 errors, 0 warnings
- 175 files, 24.741 lines of code

src/app/api/aos/finance/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server'
+import { db } from '@/lib/db'
+
+export const dynamic = 'force-dynamic'
+
+// GET /api/aos/finance — invoices with lines + company
+export async function GET() {
+  try {
+    const invoices = await db.invoice.findMany({
+      orderBy: { issueDate: 'desc' },
+      include: { company: true, lines: true },
+    })
+
+    const total = invoices.filter((i) => i.status !== 'cancelled' && i.status !== 'storno').length
+    const draft = invoices.filter((i) => i.status === 'draft').length
+    const sent = invoices.filter((i) => i.status === 'sent').length
+    const paid = invoices.filter((i) => i.status === 'paid').length
+    const overdue = invoices.filter((i) => i.status === 'overdue').length
+    const zugferdCount = invoices.filter((i) => i.zugferd).length
+    const xrechnungCount = invoices.filter((i) => i.xrechnung).length
+    const datevCount = invoices.filter((i) => i.datevExported).length
+    const outstandingCents = invoices
+      .filter((i) => i.status === 'sent' || i.status === 'overdue')
+      .reduce((s, i) => s + i.grossCents, 0)
+
+    return NextResponse.json({
+      invoices,
+      stats: { total, draft, sent, paid, overdue, zugferdCount, xrechnungCount, datevCount, outstandingCents },
+    })
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : 'internal server error'
+    return NextResponse.json({ error: msg }, { status: 500 })
+  }
+}