audit: 33-agent comprehensive audit + critical fixes

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/next-in-line-notify.service.ts

@@ -16,6 +16,7 @@ import { db } from '@/lib/db';
 import { userPortRoles, roles, type RolePermissions } from '@/lib/db/schema/users';
 import { logger } from '@/lib/logger';
 import { createNotification } from '@/lib/services/notifications.service';
+import { STAGE_LABELS, type PipelineStage } from '@/lib/constants';
 
 export interface BerthReleaseNotificationInput {
   portId: string;
@@ -59,8 +60,9 @@ export async function notifyNextInLine(input: BerthReleaseNotificationInput): Pr
   // 2. Build a single description listing the next interests so the
   //    rep can act on it without opening the berth detail page first.
   const previewLines = input.nextInLineInterests.slice(0, 5).map((i) => {
-    const days = i.pipelineStage.replace(/_/g, ' ');
-    return `${i.clientName ?? '(unknown)'} — ${days}`;
+    const stageLabel =
+      STAGE_LABELS[i.pipelineStage as PipelineStage] ?? i.pipelineStage.replace(/_/g, ' ');
+    return `${i.clientName ?? '(unknown)'} — ${stageLabel}`;
   });
   const more =
     input.nextInLineInterests.length > 5