feat: Team leader role permissions, certificate generation, and bug fixes

- Add team_leader access to /admin/users endpoint for user list viewing
- Add PDF certificate generation for AI Kurzy with Puppeteer
- Add certificate assets (background, signatures)
- Add getPrilohaById and download endpoint for attachments
- Fix time tracking service permissions for team_leader
- Fix timesheet controller/service permissions for team_leader
- Fix calendar badge to include reminders in count
- Add lastSeen to message service for online indicator

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/services/ai-kurzy/registracie.service.js

@@ -233,3 +233,13 @@ export const deletePriloha = async (id) => {
   await db.delete(prilohy).where(eq(prilohy.id, id));
   return { success: true, filePath: priloha.cestaKSuboru };
 };
+
+export const getPrilohaById = async (id) => {
+  const [priloha] = await db
+    .select()
+    .from(prilohy)
+    .where(eq(prilohy.id, id))
+    .limit(1);
+
+  return priloha || null;
+};