chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/app/api/v1/me/avatar/route.ts

@@ -17,7 +17,7 @@ const MAX_AVATAR_BYTES = 2 * 1024 * 1024;
  * table (so an S3↔filesystem swap carries it correctly), and writes
  * the file id into `user_profiles.avatar_file_id`.
  *
- * Files are scoped to the user's CURRENT port — the rep can't end up
+ * Files are scoped to the user's CURRENT port - the rep can't end up
  * with an avatar that's only visible from one port. (Avatars render
  * via the GET handler below, which presigns by id regardless of port.)
  */
@@ -98,7 +98,7 @@ export const POST = withAuth(async (req, ctx) => {
       .where(eq(userProfiles.userId, ctx.userId));
 
     if (priorAvatarId && priorAvatarId !== record.id) {
-      // Best-effort delete — a stale-blob failure shouldn't fail the
+      // Best-effort delete - a stale-blob failure shouldn't fail the
       // new-avatar response. deleteFile handles ref-check + blob
       // delete + audit so a referenced file (somehow) is safe.
       try {
@@ -111,7 +111,7 @@ export const POST = withAuth(async (req, ctx) => {
       } catch (err) {
         logger.warn(
           { err, priorAvatarId, userId: ctx.userId },
-          'avatar replace: failed to clean up prior avatar file — orphan blob possible',
+          'avatar replace: failed to clean up prior avatar file - orphan blob possible',
         );
       }
     }