feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

frontend/src/pages/Settings.tsx

@@ -1,10 +1,21 @@
-// TODO: P3-F1/F2 — Replace import * as LucideIcons with explicit icon imports
 import React, { useMemo } from 'react';
-// TODO: P2-F2 — Replace hardcoded settings nav items with dynamic config
 import { NavLink, Outlet } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import { usePluginStore } from '@/store/pluginStore';
-import * as LucideIcons from 'lucide-react';
+import { Settings, Mail, Bell, Sparkles, Bot, Shield, Users, UsersRound, Package } from 'lucide-react';
+
+const ICON_MAP: Record<string, React.ComponentType<{ className?: string }>> = {
+  Settings,
+  Mail,
+  Bell,
+  Sparkles,
+  Bot,
+  Shield,
+  Users,
+  UsersRound,
+};
+
+const FALLBACK_ICON = Package;
 
 export function SettingsPage() {
   const { t } = useTranslation();
@@ -37,8 +48,8 @@ export function SettingsPage() {
       to: `/settings/${p.path}`,
       label: t(p.label_key, p.label),
       icon: (() => {
-        const Icon = (LucideIcons as any)[p.icon];
-        return Icon ? React.createElement(Icon, { className: 'w-4 h-4' }) : '\ud83d\udce6';
+        const Icon = ICON_MAP[p.icon] ?? FALLBACK_ICON;
+        return React.createElement(Icon, { className: 'w-4 h-4' });
       })(),
     }));