feat: Team leader role permissions, certificate generation, and bug fixes

- Add team_leader access to /admin/users endpoint for user list viewing
- Add PDF certificate generation for AI Kurzy with Puppeteer
- Add certificate assets (background, signatures)
- Add getPrilohaById and download endpoint for attachments
- Fix time tracking service permissions for team_leader
- Fix timesheet controller/service permissions for team_leader
- Fix calendar badge to include reminders in count
- Add lastSeen to message service for online indicator

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

package.json

@@ -32,6 +32,7 @@
     "multer": "^2.0.2",
     "node-cron": "^4.2.1",
     "pg": "^8.16.3",
+    "puppeteer": "^24.36.1",
     "uuid": "^13.0.0",
     "web-push": "^3.6.7",
     "xss-clean": "^0.1.4",