chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/lib/services/portal.service.ts

@@ -249,7 +249,7 @@ export async function getClientInvoices(
     .map((c) => c.value.toLowerCase());
 
   // G-I5: the most common B2B pattern is "individual client buys through their
-  // company" — those invoices ship with billingEntityType='company' and the
+  // company" - those invoices ship with billingEntityType='company' and the
   // portal user (client) is just a director of that company. Filtering on
   // billingEmail alone hides these invoices. Resolve director memberships
   // through company_memberships (role='director', active = endDate IS NULL)
@@ -292,7 +292,7 @@ export async function getClientInvoices(
 
   // Fetch only the invoices matching any of the client's email addresses or
   // company memberships. Without the predicate push-down here every portal
-  // invoice page-load full-scanned the invoices table and filtered in JS —
+  // invoice page-load full-scanned the invoices table and filtered in JS -
   // by 12mo it would have been the worst portal endpoint in the platform.
   // Defensive limit 100 caps the upper bound for clients with abnormally many
   // invoices.
@@ -350,7 +350,7 @@ export async function getDocumentDownloadUrl(
 
   // M-IN01: 4-hour TTL for portal links so clients clicking on a saved
   // email don't see "link expired" after 15 minutes. Storage backend's
-  // default is 900s — that's appropriate for in-CRM previews but
+  // default is 900s - that's appropriate for in-CRM previews but
   // hostile for end-clients who may revisit a doc the next morning.
   return presignDownloadUrl(file.storagePath, 4 * 3600);
 }