fix: resolve frontend audit findings

Repair investment recovery, draft preservation, date validation,
currency presentation, accessibility, and route error recovery.
Correct Docker and dependency checks and consume explicit income roles.

src/entities/bank-card/model/form-validation.ts

@@ -16,7 +16,7 @@ function bankDateInputValue(value: string) {
 	return value.replace(/^(\d{2})\.(\d{2})\.(\d{4})$/, "$3-$2-$1");
 }
 function bankMonth(value: string | null) {
-	return value && /^\d{4}-(0[1-9]|1[0-2])$/.test(value)
+	return value && value >= "0001-01" && /^\d{4}-(0[1-9]|1[0-2])$/.test(value)
 		? value
 		: bankToday().slice(0, ISO_MONTH_LENGTH);
 }

src/entities/bank-card/model/period.test.ts

@@ -0,0 +1,25 @@
+import { afterEach, expect, it, vi } from "vitest";
+import { bankPeriod } from "./period";
+
+afterEach(() => vi.useRealTimers());
+
+it.each([
+	["0001-01", "0001-01-01", "0001-01-31"],
+	["0099-12", "0099-12-01", "0099-12-31"],
+	["2026-09", "2026-09-01", "2026-09-30"],
+	["2024-02", "2024-02-01", "2024-02-29"],
+	["0004-02", "0004-02-01", "0004-02-29"],
+])("keeps the ISO year for legacy month %s", (month, from, to) => {
+	expect(bankPeriod(new URLSearchParams({ month }))).toEqual({ from, to });
+});
+
+it("rejects zero year consistently in legacy and explicit periods", () => {
+	vi.useFakeTimers();
+	vi.setSystemTime(new Date("2026-09-27T10:00:00Z"));
+	for (const query of ["month=0000-01", "from=0000-01-01&to=0000-01-31"]) {
+		expect(bankPeriod(new URLSearchParams(query))).toEqual({
+			from: "2026-09-01",
+			to: "2026-09-30",
+		});
+	}
+});

src/entities/bank-card/model/period.ts

@@ -1,10 +1,12 @@
-import dayjs from "dayjs";
 import { z } from "zod";
 import { bankMonth } from "./form-validation";
 
 const calendarDate = z.string().date();
+const ISO_DATE_LENGTH = 10;
 function bankPeriod(params: URLSearchParams) {
 	const month = bankMonth(params.get("month"));
+	const monthEnd = new Date(`${month}-01T00:00:00Z`);
+	monthEnd.setUTCMonth(monthEnd.getUTCMonth() + 1, 0);
 	const from = params.get("from");
 	const to = params.get("to");
 	return from &&
@@ -16,7 +18,7 @@ function bankPeriod(params: URLSearchParams) {
 		? { from, to }
 		: {
 				from: `${month}-01`,
-				to: dayjs(`${month}-01`).endOf("month").format("YYYY-MM-DD"),
+				to: monthEnd.toISOString().slice(0, ISO_DATE_LENGTH),
 			};
 }