Fix UI glitches, backend security issues, and bump to 7.3.x

[houssemexo26]

Frontend

• 7 admin CRUD pages (Clients, Projects, Features, Teams, Codes, TypesCodes, Settings) had their table width/spacing CSS scoped to ids that don't exist in the DOM, so it never applied outside the Activities tab.
• Added delete confirmation to every admin list and team members - none of them had one.
• Fixed transaprent typo on the Time Tracking/Time Sheet/Activity Management app roots.
• Fixed Filter drawer's Project field showing "Sub Activity Code" as its label.
• Fixed TimeTrackingDrawer's outside-click handler (was calling native click() instead of addEventListener, firing a spurious click on mount).
• Fixed floating-point noise in the daily total display.
• Removed a global unscoped style rule that added a 30px gap to every table in the app; scoped it to the time sheet table only.
• Localized hardcoded English table headers and confirm dialogs.
• Fixed repeating DELETE requests after deleting a timesheet entry: the pending-delete state was never cleared after firing, so any later unrelated toast dismissing anywhere in the app re-fired the same delete against an already-deleted record.
• Fixed a race condition where starting a second deletion before the first one's undo window elapsed could silently drop the first deletion or delete the wrong row.
• Fixed Undo not actually cancelling a pending deletion: closeAlert() could synchronously re-trigger the dismiss handler before the pending state was cleared.
• Fixed a long team list wrapping to 3 lines on the Activities tab, blowing up that row's height; now truncated with a tooltip for the full list.
• Misc cleanup: dead CSS, 22 no-op confirmDialog assignments, sub-pixel border, forced scrollbar.

Backend

• Fixed IDOR: any user could update/delete another user's activity records, and delete another user's saved filter.
• Fixed JPQL injection via unvalidated sortBy query param.
• Restricted an endpoint that dumped every user's activity records to managers only.
• Fixed userName spoofing on activity record creation.
• Fixed the root cause of DELETE activityrecord/{id} returning 500 instead of 404: 8 storage classes threw org.gatein.api.EntityNotFoundException while every layer above caught jakarta.persistence's, so the exception was never actually caught. Fixed the same mismatch everywhere and mapped it to 404 across all REST classes.
• Stopped TeamStorage from swallowing every exception on team/team-member create/update/delete, which was masking real failures as success.
• Removed a race condition (unsynchronized static field) and an unbounded, never-invalidated static cache in TeamService/TeamStorage.

Build

• Bumped parent pom to 21-M01, io.meeds.social to 7.3.x-SNAPSHOT, project version to 1.3.x-SNAPSHOT.
• Dropped the explicit commons-component-common dependency and its version property: social-component-core already brings it in transitively at the same scope.