chore(autonomous-session): consolidate uncommitted work from prior session

Bundles the prior autonomous-session output that was sitting unstaged:

- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
  never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
  after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
  redirects (ocr to ai, reports to dashboard, invitations to users),
  docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
  flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
  let-reassign), set-state-in-effect disables in CountryFlag and
  UploadForSigning preview-bytes effect, unused 'confirm' destructures in
  interest contract + reservation tabs, unescaped apostrophe in test-template
  card copy

tests/unit/storage/filesystem-backend.test.ts

@@ -17,7 +17,7 @@ import { tmpdir } from 'node:os';
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 
 // Stub the env module BEFORE importing the backend so the
-// MULTI_NODE_DEPLOYMENT toggle works — env is now read from the zod
+// MULTI_NODE_DEPLOYMENT toggle works - env is now read from the zod
 // schema once at module load, not from process.env at runtime.
 vi.mock('@/lib/env', async () => {
   const actual = await vi.importActual<typeof import('@/lib/env')>('@/lib/env');
@@ -102,7 +102,7 @@ describe('FilesystemBackend realpath check', () => {
     // realpath'd storage root. Note: Node's path.resolve doesn't follow
     // symlinks; the runtime guard relies on the resolved target string staying
     // under rootResolved. Since the symlink itself lives under root, path.resolve
-    // would produce <root>/evil/file.txt — which IS under root by string check.
+    // would produce <root>/evil/file.txt - which IS under root by string check.
     // The defense-in-depth here is that the storage root itself is realpath'd
     // at create time, AND the OS perms (0o700) limit lateral movement. We assert
     // the obvious traversal attack still fails.
@@ -140,7 +140,7 @@ describe('FilesystemBackend realpath check', () => {
     const prev = env.MULTI_NODE_DEPLOYMENT;
     // The backend reads env.MULTI_NODE_DEPLOYMENT (zod-validated, set
     // once at module load). Mutate the in-memory env for the duration of
-    // this case — the surrounding vi.mock() above keeps every other env
+    // this case - the surrounding vi.mock() above keeps every other env
     // field intact.
     (env as unknown as { MULTI_NODE_DEPLOYMENT: boolean }).MULTI_NODE_DEPLOYMENT = true;
     try {