fix(audit-final): pre-merge hardening + expense receipt UI

Final audit pass on feat/berth-recommender (3 parallel Opus agents)
caught 5 critical and ~12 high-severity findings. All addressed in-branch;
medium/low items deferred to docs/audit-final-deferred.md.

Critical:
- Add filesystem-backend PUT handler at /api/storage/[token] so
  presigned uploads stop 405-ing in filesystem mode (every browser-driven
  berth-PDF + brochure upload was broken). Same token-verify + replay
  protection as GET, plus magic-byte gate when c=application/pdf.
- Forward req.signal into streamExpensePdf so an aborted 1000-receipt
  export no longer keeps grinding for minutes.
- Strengthen Content-Disposition filename sanitization: \s matches CR/LF
  which would let documentName forge headers; restrict to [\w. -]+ and
  add filename* RFC 5987 fallback.
- Lock public berths feed behind an explicit slug allowlist instead of
  ?portSlug= enumeration.
- Reject cross-port interest_berths upserts (defense-in-depth on top of
  the recommender SQL port filter).

High:
- Recommender: width-only feasibility now caps length via L/W ratio so a
  200ft berth doesn't surface for a 30ft beam request; total_interest_count
  filters out junction rows whose interest is in another port.
- Mooring normalization follow-up migration (0034) catches un-hyphenated
  padded forms (A01) the original 0024 WHERE missed.
- Send-out rate limit moved AFTER validation and scoped per-(port, user)
  so typos don't burn a slot and a multi-port rep can't be DoS'd by
  another tenant.
- Default-brochure path now blocks an archived row from sneaking through
  the partial unique index.
- NocoDB import --update-snapshot honoured under --dry-run so reps can
  refresh the seed JSON without committing DB writes.
- PDF export: orderBy desc(expenseDate); apply isNull(archivedAt) when
  expenseIds are passed (was bypassed); flag rate-unavailable rows with
  an amber footer instead of silently treating them as 1:1; skip the
  USD->EUR chain when source already matches target.
- expense-form-dialog: revokeObjectURL captures the URL in the closure
  instead of revoking the still-displayed one; reset upload state on
  close.
- scan/page: handleClearReceipt resets in-flight scan/upload mutations;
  Save disabled while upload pending.
- updateExpense re-asserts receipt-or-acknowledgement at the merged
  row so PATCH can't slip past the create-time refine.

Plus the in-progress receipt upload UI for the expense form dialog
(receipt picker + "I have no receipt" checkbox + warning banner) and
a noReceiptAcknowledged flag on ExpenseRow for edit-mode hydration.

Includes the canonical plan doc (referenced in CLAUDE.md), the handoff
prompt, and a deferred-findings index for follow-up issues.

1163/1163 vitest passing. Typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/import-berths-from-nocodb.ts

@@ -374,8 +374,17 @@ async function main(): Promise<void> {
     if (orphans.length > 10) console.log(`      …and ${orphans.length - 10} more`);
   }
 
+  // Snapshot write is independent of DB writes — even in --dry-run mode
+  // a rep may want to refresh the seed JSON to capture the latest NocoDB
+  // shape without committing to the DB import. The original gate dropped
+  // this silently when --dry-run was passed; audit caught it.
+  if (args.updateSnapshot) {
+    const written = await writeSnapshot(dedup);
+    console.log(`> Wrote ${dedup.length} rows to ${path.relative(process.cwd(), written)}`);
+  }
+
   if (args.dryRun) {
-    console.log(`\n[dry-run] no writes performed.`);
+    console.log(`\n[dry-run] no DB writes performed.`);
     return;
   }
 
@@ -390,11 +399,6 @@ async function main(): Promise<void> {
     for (const w of result.warnings.slice(0, 20)) console.log(`    - ${w}`);
     if (result.warnings.length > 20) console.log(`    …and ${result.warnings.length - 20} more`);
   }
-
-  if (args.updateSnapshot) {
-    const written = await writeSnapshot(dedup);
-    console.log(`> Wrote ${dedup.length} rows to ${path.relative(process.cwd(), written)}`);
-  }
 }
 
 main()

scripts/smoke-test-redirect.ts

@@ -32,14 +32,13 @@ async function main() {
   const nodemailer = await import('nodemailer');
   const captured: Array<{ to: unknown; subject: unknown; from: unknown }> = [];
   const originalCreateTransport = nodemailer.default.createTransport;
-  // @ts-expect-error monkey-patch
-  nodemailer.default.createTransport = () => ({
+  nodemailer.default.createTransport = (() => ({
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     sendMail: async (msg: any) => {
       captured.push({ to: msg.to, subject: msg.subject, from: msg.from });
       return { messageId: '<smoke@test>', accepted: [msg.to], rejected: [] };
     },
-  });
+  })) as unknown as typeof nodemailer.default.createTransport;
 
   // Now import sendEmail (gets the patched transporter).
   const { sendEmail } = await import('@/lib/email');
@@ -55,7 +54,6 @@ async function main() {
   await sendEmail(realClientEmail, realSubject, '<p>Body unused for this smoke.</p>');
 
   // Restore the original transport (be a good citizen).
-  // @ts-expect-error monkey-patch
   nodemailer.default.createTransport = originalCreateTransport;
 
   console.log('[smoke] captured outbound message:');