chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

tests/unit/security-sensitive-data.test.ts

@@ -16,7 +16,7 @@ import { maskSensitiveFields } from '@/lib/audit';
 
 // ─────────────────────────────────────────────────────────────────────────────
 
-describe('Sensitive data masking — field detection', () => {
+describe('Sensitive data masking - field detection', () => {
   it('masks "email" field', () => {
     const result = maskSensitiveFields({ email: 'user@example.com' });
     expect(result?.email).not.toBe('user@example.com');
@@ -48,7 +48,7 @@ describe('Sensitive data masking — field detection', () => {
   });
 });
 
-describe('Sensitive data masking — masking format', () => {
+describe('Sensitive data masking - masking format', () => {
   it('long email (len > 4) uses partial mask: first 2 + *** + last 2', () => {
     // 'user@example.com' → 'us***om'
     const result = maskSensitiveFields({ email: 'user@example.com' });
@@ -84,7 +84,7 @@ describe('Sensitive data masking — masking format', () => {
   });
 });
 
-describe('Sensitive data masking — non-sensitive fields', () => {
+describe('Sensitive data masking - non-sensitive fields', () => {
   it('preserves string non-sensitive fields unchanged', () => {
     const result = maskSensitiveFields({ name: 'John Smith', status: 'active' });
     expect(result?.name).toBe('John Smith');
@@ -122,7 +122,7 @@ describe('Sensitive data masking — non-sensitive fields', () => {
   });
 });
 
-describe('Sensitive data masking — edge cases', () => {
+describe('Sensitive data masking - edge cases', () => {
   it('returns undefined for undefined input', () => {
     expect(maskSensitiveFields(undefined)).toBeUndefined();
   });
@@ -139,7 +139,7 @@ describe('Sensitive data masking — edge cases', () => {
     expect(original.email).toBe(originalEmail);
   });
 
-  it('only masks string values — non-string sensitive fields are left as-is', () => {
+  it('only masks string values - non-string sensitive fields are left as-is', () => {
     // e.g. if someone stores a number in an "email" field (type error upstream),
     // the masking logic gracefully skips it (typeof check)
     const result = maskSensitiveFields({ email: 12345 as unknown as string });