chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

src/lib/services/settings.service.ts

@@ -40,7 +40,7 @@ export async function getSetting(key: string, portId: string) {
 export async function upsertSetting(key: string, value: unknown, portId: string, meta: AuditMeta) {
   // Read existing first for the audit-log diff (before/after). The actual
   // write goes through onConflictDoUpdate so two concurrent calls can't
-  // both observe `existing=null` and both INSERT — the (key, port_id)
+  // both observe `existing=null` and both INSERT - the (key, port_id)
   // unique index now treats NULLs as equal (migration 0047).
   const existing = await db.query.systemSettings.findFirst({
     where: and(eq(systemSettings.key, key), eq(systemSettings.portId, portId)),
@@ -66,7 +66,7 @@ export async function upsertSetting(key: string, value: unknown, portId: string,
   // H-06: keys ending with `_encrypted` carry AES-GCM ciphertext that's only
   // useful with EMAIL_CREDENTIAL_KEY. Recording the ciphertext verbatim in
   // audit_logs.new_value would turn the audit log (readable by any admin
-  // with `admin.view_audit_log`) into a credential bundle — if the
+  // with `admin.view_audit_log`) into a credential bundle - if the
   // encryption key is ever rotated/leaked the history exfils every
   // configured password. Mask the value but keep the audit trail itself
   // (who toggled what, when).