chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/app/(portal)/layout.tsx

@@ -60,7 +60,7 @@ export default async function PortalLayout({ children }: { children: React.React
   // Branding for the auth-shell pages (login, forgot-password, reset).
   // When the visitor has a session, use that port's branding so they
   // stay inside one tenant's look. Otherwise pick up the first-port
-  // default — the same path the CRM auth pages take.
+  // default - the same path the CRM auth pages take.
   const branding = session
     ? await getPortBrandingConfig(session.portId)
         .then((cfg) => ({

src/app/(portal)/portal/interests/page.tsx

@@ -85,7 +85,7 @@ export default async function PortalInterestsPage() {
                     )}
                   </div>
                   {/* leadCategory ("hot_lead" / "qualified_lead" / etc.)
-                      is a staff classification — never render to clients.
+                      is a staff classification - never render to clients.
                       Privacy + optics: we shouldn't be telling the
                       prospect they're a "hot lead". */}
                   <div className="flex flex-wrap gap-2 mt-2 text-xs text-gray-400">

src/app/(portal)/portal/login/page.tsx

@@ -14,7 +14,7 @@ import { BrandedAuthShell } from '@/components/shared/branded-auth-shell';
  * Validate the `?next=` post-login redirect target. auth-flow-auditor M10:
  * an unvalidated `next` lets `/portal/login?next=https://evil.example`
  * navigate cross-site after sign-in. Only allow same-origin paths
- * scoped to the portal surface — anything else falls back to the
+ * scoped to the portal surface - anything else falls back to the
  * dashboard.
  */
 function safeNextPath(raw: string | null): string {