audit: 33-agent comprehensive audit + critical fixes

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/shared/interest-picker.tsx

@@ -16,6 +16,7 @@ import {
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover';
 import { useDebounce } from '@/hooks/use-debounce';
 import { apiFetch } from '@/lib/api/client';
+import { stageLabel } from '@/lib/constants';
 import { cn } from '@/lib/utils';
 
 interface InterestOption {
@@ -71,7 +72,7 @@ export function InterestPicker({
   const labelFor = (o: InterestOption) => {
     const parts = [o.clientName ?? 'Unknown client'];
     if (o.berthMooringNumber) parts.push(`Berth ${o.berthMooringNumber}`);
-    parts.push(o.pipelineStage.replace(/_/g, ' '));
+    parts.push(stageLabel(o.pipelineStage));
     return parts.join(' · ');
   };
 

src/components/shared/realtime-toasts.tsx

@@ -4,7 +4,7 @@ import { useEffect } from 'react';
 import { toast } from 'sonner';
 
 import { useSocket } from '@/providers/socket-provider';
-import { stageLabel } from '@/lib/constants';
+import { stageLabel, formatOutcome } from '@/lib/constants';
 
 /**
  * App-wide subscriber that surfaces high-signal sales events as sonner
@@ -62,9 +62,9 @@ export function RealtimeToasts() {
     function onOutcomeSet(payload: { outcome?: string }) {
       if (!payload?.outcome) return;
       const isWon = payload.outcome === 'won';
-      const label = payload.outcome.replace(/_/g, ' ');
+      const label = formatOutcome(payload.outcome) ?? payload.outcome;
       const fn = isWon ? toast.success : toast.message;
-      fn(`Interest closed - ${label}`);
+      fn(`Interest closed — ${label}`);
     }
 
     socket.on('interest:stageChanged', onStageChanged);