fix: address cashbox-export whole-branch review findings

- Reject dates that are not strict YYYY-MM-DD (was accepting full ISO
  datetimes, which silently produced empty exports instead of a 400)
  and reject from > to with a 400 before touching the team/DB.
- Emit the cashbox_export_download and cashbox_export_subscription_update
  audit log events that were declared but never fired, matching the
  audit trail every sibling feature already has.
- Restore full type checking on the pdfkit import via `import = require()`
  instead of an untyped require() with an eslint-disable.
- Tighten a cashbox.spec.ts assertion to check the exact dialog class
  instead of expect.anything(), so it can't pass with the wrong dialog
  wired to the Export button.
- Style and announce the export dialogs' error messages using this
  codebase's established error-message/role=alert pattern.

myteamwallet_backend/src/cashbox-export/cashbox-export.http.spec.ts

@@ -67,6 +67,24 @@ describe('cashbox export HTTP boundary', () => {
     expect(service.exportForUser).not.toHaveBeenCalled();
   });
 
+  it('rejects a full ISO datetime instead of a plain YYYY-MM-DD date for from', async () => {
+    await request(app.getHttpServer())
+      .get(
+        '/api/v1/cashbox-export/5?from=2026-08-01T12:00:00Z&to=2026-08-31&format=csv',
+      )
+      .set('Authorization', 'Bearer user')
+      .expect(422);
+    expect(service.exportForUser).not.toHaveBeenCalled();
+  });
+
+  it('rejects a malformed date string for to', async () => {
+    await request(app.getHttpServer())
+      .get('/api/v1/cashbox-export/5?from=2026-08-01&to=not-a-date&format=csv')
+      .set('Authorization', 'Bearer user')
+      .expect(422);
+    expect(service.exportForUser).not.toHaveBeenCalled();
+  });
+
   it('returns a CSV file with correct headers and content', async () => {
     const csvBuffer = Buffer.from('Datum;Typ;Wer;Notiz;Betrag;Periodensaldo', 'utf-8');
     service.exportForUser.mockResolvedValue({