chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms

Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.

PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
     phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
     and company.{incorporationCountryIso, incorporationSubdivisionIso}.
     Server-side parsePhone() fallback for legacy raw phone strings.

PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
     'audit.suspicious_login') were registered but evaluators returned [].
     Both required schema/instrumentation that hadn't landed. Removed from
     the registry; comments record the dependencies needed to revive them.
     Effective rule count: 8 active.

PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
     integration test files; webhook-delivery uses vi.hoisted for the
     queue-add ref. Vitest no longer warns about non-top-level mocks.
     Deflaked the 'short value' assertion in security-encryption.test.ts
     by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.

PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
     now filter by isNull(archivedAt). Berths use status (no archivedAt).

PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
     walks every src/app/api/v1/**/route.ts and reports handlers without a
     withPermission() wrapper. Initial run found 33 violations.
     - Allow-listed 17 with explicit reasons (self-data, admin, alerts,
       search, currency, ai, custom-fields — some marked TODO).
     - Wrapped 7 routes with concrete permissions: clients/options
       (clients:view), berths/options (berths:view), dashboard/*
       (reports:view_dashboard), analytics (reports:view_analytics).
     Audit report at docs/runbooks/permission-audit.md. Script exits
     non-zero on any unallow-listed violation so it can become a CI gate.

Vitest: 741 -> 741 (no new tests; existing suite covers the changes).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/validators/interests.ts

@@ -2,6 +2,11 @@ import { z } from 'zod';
 
 import { baseListQuerySchema } from '@/lib/api/route-helpers';
 import { PIPELINE_STAGES, LEAD_CATEGORIES } from '@/lib/constants';
+import {
+  optionalCountryIsoSchema,
+  optionalPhoneE164Schema,
+  optionalSubdivisionIsoSchema,
+} from '@/lib/validators/i18n';
 
 // ─── Create ──────────────────────────────────────────────────────────────────
 
@@ -69,9 +74,15 @@ export const generateRecommendationsSchema = z.object({
 const addressSchema = z.object({
   street: z.string().max(500).optional(),
   city: z.string().max(200).optional(),
+  /** Legacy free-text. New writes use `subdivisionIso`. */
   stateProvince: z.string().max(200).optional(),
+  /** ISO 3166-2 subdivision code (e.g. 'PL-MZ'). */
+  subdivisionIso: optionalSubdivisionIsoSchema.optional(),
   postalCode: z.string().max(50).optional(),
+  /** Legacy free-text. New writes use `countryIso`. */
   country: z.string().max(100).optional(),
+  /** ISO-3166-1 alpha-2 country code. */
+  countryIso: optionalCountryIsoSchema.optional(),
 });
 
 // Nested yacht block. Public submissions must now include yacht data because the
@@ -94,7 +105,12 @@ const publicCompanySchema = z.object({
   name: z.string().min(1).max(200),
   legalName: z.string().max(200).optional(),
   taxId: z.string().max(100).optional(),
+  /** Legacy free-text. New website builds should send `incorporationCountryIso`. */
   incorporationCountry: z.string().max(100).optional(),
+  /** ISO-3166-1 alpha-2 country of incorporation. */
+  incorporationCountryIso: optionalCountryIsoSchema.optional(),
+  /** ISO 3166-2 state/province of incorporation. */
+  incorporationSubdivisionIso: optionalSubdivisionIsoSchema.optional(),
   role: z
     .enum([
       'director',
@@ -119,6 +135,12 @@ export const publicInterestSchema = z
     fullName: z.string().min(1).max(200).optional(),
     email: z.string().email(),
     phone: z.string().min(1),
+    /** Pre-normalized E.164 form, optional for backwards compat. */
+    phoneE164: optionalPhoneE164Schema.optional(),
+    /** ISO-3166-1 alpha-2 country the phone was parsed against. */
+    phoneCountry: optionalCountryIsoSchema.optional(),
+    /** ISO-3166-1 alpha-2 nationality. */
+    nationalityIso: optionalCountryIsoSchema.optional(),
     preferredContactMethod: z.enum(['email', 'phone', 'sms']).optional(),
     mooringNumber: z.string().max(50).optional(),
     // NEW: required structured yacht block. Public submissions after the