chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

tests/integration/portal-auth.test.ts

@@ -1,5 +1,5 @@
 /**
- * Portal JWT verification — locks in the audience/issuer hardening shipped
+ * Portal JWT verification - locks in the audience/issuer hardening shipped
  * in fix(auth): a token without `aud: 'portal'` + `iss: 'pn-crm'` claims
  * must NOT verify, even if it's signed with the correct shared secret.
  *
@@ -50,7 +50,7 @@ describe('portal JWT', () => {
   });
 
   it('rejects a token missing the `aud: portal` claim', async () => {
-    // Issuer present, audience absent — exactly the shape an old (pre-fix)
+    // Issuer present, audience absent - exactly the shape an old (pre-fix)
     // portal session would have.
     const token = await new SignJWT(SESSION as unknown as Record<string, unknown>)
       .setProtectedHeader({ alg: 'HS256' })
@@ -74,7 +74,7 @@ describe('portal JWT', () => {
   });
 
   it('rejects a token with the wrong audience (CRM session replay shape)', async () => {
-    // What a better-auth session token might roughly look like — same secret,
+    // What a better-auth session token might roughly look like - same secret,
     // different audience. Must not verify against the portal path.
     const token = await new SignJWT(SESSION as unknown as Record<string, unknown>)
       .setProtectedHeader({ alg: 'HS256' })