feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

tests/test_entity_links.py

@@ -485,3 +485,45 @@ async def test_list_contact_files_empty(authed_client: AsyncClient):
     resp = await client.get(f"/api/v1/contacts/{contact_id}/files", headers=ORIGIN_HEADER)
     assert resp.status_code == 200
     assert resp.json() == []
+
+
+# ─── Cross-tenant isolation test ───
+
+
+@pytest.mark.asyncio
+async def test_cross_tenant_entity_link_isolation(plugin_app, db_session):
+    """Entity link created in tenant A is not visible to tenant B."""
+    from tests.conftest import seed_tenant_and_users
+
+    seed = await seed_tenant_and_users(db_session)
+    transport = ASGITransport(app=plugin_app)
+
+    async with AsyncClient(transport=transport, base_url="http://test") as client_a:
+        await login_client(client_a, "admin@tenanta.com")
+        # Upload a file in tenant A
+        upload_resp = await client_a.post(
+            "/api/v1/dms/files/upload",
+            files={"file": ("tenant_a_link.txt", b"tenant a link", "text/plain")},
+            headers=ORIGIN_HEADER,
+        )
+        assert upload_resp.status_code == 201
+        file_id = upload_resp.json()["id"]
+        company_id = str(seed["company_a"].id)
+
+        # Link file to company_a in tenant A
+        link_resp = await client_a.post(
+            f"/api/v1/entity-links/files/{file_id}/link",
+            json={"entity_type": "company", "entity_id": company_id},
+            headers=ORIGIN_HEADER,
+        )
+        assert link_resp.status_code == 200
+
+        # Tenant B admin must not see tenant A's link
+        async with AsyncClient(transport=transport, base_url="http://test") as client_b:
+            await login_client(client_b, "admin@tenantb.com")
+            links_resp = await client_b.get(
+                f"/api/v1/entity-links/files/{file_id}/links",
+                headers=ORIGIN_HEADER,
+            )
+            assert links_resp.status_code == 200
+            assert links_resp.json() == []