feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

frontend/src/components/comm/blocks/HtmlBlock.tsx

@@ -1,4 +1,3 @@
-// TODO: P3-F21 — Remove redundant regex before DOMPurify
 import React from 'react';
 import DOMPurify from 'dompurify';
 import type { MessageBlock } from '@/store/commStore';
@@ -14,13 +13,7 @@ const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
     return null;
   }
 
-  // Replace javascript: URLs in href attributes before sanitizing
-  const safeHtml = rawHtml.replace(
-    /href\s*=\s*(["'])\s*javascript:[^"']*\1/gi,
-    'href=$1#$1'
-  );
-
-  const sanitized = DOMPurify.sanitize(safeHtml);
+  const sanitized = DOMPurify.sanitize(rawHtml);
 
   return (
     <div