feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

tests/conftest.py

@@ -434,6 +434,49 @@ async def seed_tenant_and_users(db: AsyncSession) -> dict[str, Any]:
     }
 
 
+async def create_no_perm_user(db: AsyncSession, seed: dict[str, Any]) -> User:
+    """Create a user in tenant A with no permissions (for RBAC tests).
+
+    Returns the created user. The user has a role with empty permissions,
+    so any require_permission check will return 403.
+    """
+    from app.core.auth import hash_password
+    from app.models.role import Role
+    from app.models.user import User, UserTenant
+
+    no_perm_role = Role(
+        tenant_id=seed["tenant_a"].id,
+        name="no_perm",
+        permissions={},
+        denied_permissions=[],
+        field_permissions={},
+    )
+    db.add(no_perm_role)
+    await db.flush()
+
+    no_perm_user = User(
+        email="noperm@tenanta.com",
+        name="No Perm",
+        password_hash=hash_password("TestPass123!"),
+        is_active=True,
+        preferences={},
+    )
+    db.add(no_perm_user)
+    await db.flush()
+
+    ut = UserTenant(
+        user_id=no_perm_user.id,
+        tenant_id=seed["tenant_a"].id,
+        is_default=True,
+        role="no_perm",
+        role_id=no_perm_role.id,
+    )
+    db.add(ut)
+    await db.flush()
+    await db.commit()
+    return no_perm_user
+
+
 async def login_client(
     client: AsyncClient, email: str, password: str = "TestPass123!"
 ) -> dict[str, str]: