audit: Tier 1/3/4/5/7 batch — SSE, gates, dedup, URL escape, FK constraints

Tier 1.6: S3Backend.put now sets ServerSideEncryption=AES256 — closes
the cleartext-at-rest gap for signed contracts, GDPR exports, pg_dumps.

Tier 3.7: New safeUrl() helper in lib/email/shell.ts. Scheme allow-list
(http/https/mailto/tel/relative only — javascript:/data:/vbscript:/file:
rewritten to about:blank) + HTML-attribute escape. Retrofitted across
all 7 transactional templates (crm-invite, portal-auth, document-signing,
notification-digest, residential-inquiry, admin-email-change).

Tier 4.2: /api/v1/alerts GET now gated on admin.view_audit_log.

Tier 4.3: Documenso webhook handler emits captureErrorEvent on catch.
Admin/errors no longer silent on webhook crashes.

Tier 4.6: Inquiry-funnel email dedup is now case-insensitive
(LOWER(value)) and stores normalized email on insert. Capital-letter
resubmissions no longer spawn duplicate client+yacht+interest rows.

Tier 5.6 + data-model H1: migration 0056 adds FK
user_permission_overrides.user_id → user(id) cascade, same for
user_port_roles.userId, plus partial unique index on
user_email_changes pending rows.

Tier 7.6: @types/node bumped from ^25 to ^20.19.0 — matches the runtime.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/storage/s3.ts

@@ -190,6 +190,13 @@ export class S3Backend implements StorageBackend {
     await withTimeout(
       this.client.putObject(this.bucket, key, buffer, buffer.length, {
         'Content-Type': opts.contentType,
+        // Force server-side encryption for every blob — signed contracts,
+        // GDPR exports, pg_dumps, EOI PDFs all otherwise land at rest in
+        // cleartext unless the bucket has default-encryption configured.
+        // The audit's S3-pathing CRITICAL was that this was missing.
+        // SSE-S3 (AES-256) is the right baseline; SSE-KMS can be a future
+        // upgrade for tenants that need their own keys.
+        'x-amz-server-side-encryption': 'AES256',
       }),
       STORAGE_DEFAULT_TIMEOUT_MS,
       `putObject(${key})`,