audit: 33-agent comprehensive audit + critical fixes

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/clients/client-columns.tsx

@@ -15,7 +15,7 @@ import {
 import { Badge } from '@/components/ui/badge';
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover';
 import { getCountryName } from '@/lib/i18n/countries';
-import { stageDotClass, stageLabel, formatSource } from '@/lib/constants';
+import { stageDotClass, stageLabel, formatSource, formatOutcome } from '@/lib/constants';
 import { cn } from '@/lib/utils';
 import type { ColumnPickerOption } from '@/components/shared/column-picker';
 
@@ -249,7 +249,7 @@ export function getClientColumns({
                         <span className="font-medium text-foreground">{b.mooringNumber}</span>
                         <span className="text-xs text-muted-foreground">
                           {b.outcome
-                            ? `${stageLabel(b.stage)} · ${b.outcome.replace(/_/g, ' ')}`
+                            ? `${stageLabel(b.stage)} · ${formatOutcome(b.outcome) ?? b.outcome}`
                             : stageLabel(b.stage)}
                         </span>
                       </Link>
@@ -342,7 +342,7 @@ function BerthInterestChip({
 }) {
   const isClosed = berth.outcome !== null;
   const label = isClosed
-    ? `${stageLabel(berth.stage)} · ${berth.outcome!.replace(/_/g, ' ')}`
+    ? `${stageLabel(berth.stage)} · ${formatOutcome(berth.outcome) ?? berth.outcome}`
     : stageLabel(berth.stage);
   return (
     <Link