feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

tests/test_notifications.py

@@ -116,3 +116,52 @@ class TestNotifications:
         assert "count" in data
         assert isinstance(data["count"], int)
         assert data["count"] >= 2
+
+
+# ── Cross-tenant isolation + RBAC tests ──
+
+
+@pytest.mark.asyncio
+class TestNotificationCrossTenant:
+    """Notifications must not leak across tenants."""
+
+    async def test_cross_tenant_isolation(self, client: AsyncClient, db_session):
+        """Notification for tenant A user is not visible to tenant B admin."""
+        from httpx import ASGITransport
+        from httpx import AsyncClient as AC
+
+        import app.main
+
+        seed = await seed_tenant_and_users(db_session)
+        await create_notification(
+            db_session,
+            seed["tenant_a"].id,
+            seed["admin_a"].id,
+            "info",
+            "Tenant A Notif",
+            "Body",
+        )
+        await db_session.commit()
+
+        await login_client(client, "admin@tenanta.com")
+        resp = await client.get("/api/v1/notifications")
+        assert resp.status_code == 200
+        assert any(i["title"] == "Tenant A Notif" for i in resp.json()["items"])
+
+        # Tenant B admin must not see tenant A's notification
+        app_instance = app.main.app
+        async with AC(transport=ASGITransport(app=app_instance), base_url="http://test") as client_b:
+            await login_client(client_b, "admin@tenantb.com")
+            resp_b = await client_b.get("/api/v1/notifications")
+            assert resp_b.status_code == 200
+            assert all(i["title"] != "Tenant A Notif" for i in resp_b.json()["items"])
+
+    async def test_rbac_no_permission(self, client: AsyncClient, db_session):
+        """User without notifications:read permission gets 403 on list."""
+        from tests.conftest import create_no_perm_user
+
+        seed = await seed_tenant_and_users(db_session)
+        await create_no_perm_user(db_session, seed)
+        await login_client(client, "noperm@tenanta.com")
+        resp = await client.get("/api/v1/notifications")
+        assert resp.status_code == 403