chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/lib/services/company-memberships.service.ts

@@ -134,7 +134,7 @@ export async function updateMembership(
     .set({ ...data, updatedAt: new Date() })
     // Defense-in-depth: companyMemberships has no port_id column, so the
     // tenant boundary lives on the parent company. Pin the WHERE to a
-    // sub-select of port companies — even if loadMembershipScoped were
+    // sub-select of port companies - even if loadMembershipScoped were
     // ever bypassed, a stray membershipId from another tenant cannot
     // mutate.
     .where(
@@ -185,7 +185,7 @@ export async function endMembership(
     .set({ endDate: data.endDate, updatedAt: new Date() })
     // Defense-in-depth: companyMemberships has no port_id column, so the
     // tenant boundary lives on the parent company. Pin the WHERE to a
-    // sub-select of port companies — even if loadMembershipScoped were
+    // sub-select of port companies - even if loadMembershipScoped were
     // ever bypassed, a stray membershipId from another tenant cannot
     // mutate.
     .where(
@@ -250,7 +250,7 @@ export async function setPrimary(
     const rows = await tx
       .update(companyMemberships)
       .set({ isPrimary: true, updatedAt: new Date() })
-      // Same defense-in-depth via port-companies sub-select — see updateMembership.
+      // Same defense-in-depth via port-companies sub-select - see updateMembership.
       .where(
         and(
           eq(companyMemberships.id, membershipId),