chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/components/shared/branded-auth-shell.tsx

@@ -16,7 +16,7 @@ interface BrandedAuthShellProps {
 }
 
 /**
- * Branded shell shared by every auth/form surface — CRM login, portal login,
+ * Branded shell shared by every auth/form surface - CRM login, portal login,
  * password set/reset/activate, forgot-password. Renders the background,
  * the port logo, and a centered white card that consumers populate with
  * their own form/content.
@@ -29,12 +29,12 @@ export function BrandedAuthShell({ children, branding }: BrandedAuthShellProps)
   const ctx = useAuthBranding();
   const logoUrl = branding?.logoUrl ?? ctx?.logoUrl ?? null;
   const backgroundUrl = branding?.backgroundUrl ?? ctx?.backgroundUrl ?? null;
-  // When no port name is known, treat the logo as decorative — "Sign in"
+  // When no port name is known, treat the logo as decorative - "Sign in"
   // as alt text was being read on every auth page even when the page
   // itself isn't a sign-in surface (e.g. password reset, set-password).
   const appName = branding?.appName ?? ctx?.appName ?? null;
   const altText = appName ?? '';
-  // fixed inset-0 anchors the auth surface to the viewport directly —
+  // fixed inset-0 anchors the auth surface to the viewport directly -
   // iOS Safari ignores overflow-hidden on inner divs for body-level
   // scrolling, so a regular `h-dvh overflow-hidden` wrapper doesn't
   // stop the rubber-band bounce. Pinning to the viewport via position