feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

tests/test_tasks.py

@@ -180,3 +180,49 @@ class TestTaskDelete:
         # Verify it's gone from list
         list_resp = await tasks_client.get("/api/v1/tasks", headers=ORIGIN_HEADER)
         assert not any(t["id"] == task_id for t in list_resp.json()["items"])
+
+
+# ── Cross-tenant isolation test ──
+@pytest.mark.asyncio
+class TestTaskCrossTenant:
+    """Tasks must not leak across tenants."""
+
+    async def test_cross_tenant_isolation(self, tasks_app, db_session):
+        """Task created in tenant A is not visible to tenant B."""
+        from httpx import ASGITransport, AsyncClient
+
+        await seed_tenant_and_users(db_session)
+        transport = ASGITransport(app=tasks_app)
+        async with AsyncClient(transport=transport, base_url="http://test") as client_a:
+            await login_client(client_a, "admin@tenanta.com")
+            create_resp = await client_a.post(
+                "/api/v1/tasks",
+                json={"title": "Tenant A Task"},
+                headers=ORIGIN_HEADER,
+            )
+            assert create_resp.status_code == 201
+            task_id = create_resp.json()["id"]
+
+            async with AsyncClient(transport=transport, base_url="http://test") as client_b:
+                await login_client(client_b, "admin@tenantb.com")
+                # List must not contain tenant A's task
+                list_resp = await client_b.get("/api/v1/tasks", headers=ORIGIN_HEADER)
+                assert list_resp.status_code == 200
+                assert all(t["id"] != task_id for t in list_resp.json()["items"])
+                # Get must 404
+                get_resp = await client_b.get(f"/api/v1/tasks/{task_id}", headers=ORIGIN_HEADER)
+                assert get_resp.status_code == 404
+
+    async def test_rbac_no_permission(self, tasks_client: AsyncClient, db_session):
+        """User without tasks:write permission gets 403 on create."""
+        from tests.conftest import create_no_perm_user
+
+        seed = await seed_tenant_and_users(db_session)
+        await create_no_perm_user(db_session, seed)
+        await login_client(tasks_client, "noperm@tenanta.com")
+        resp = await tasks_client.post(
+            "/api/v1/tasks",
+            json={"title": "No Perm Task"},
+            headers=ORIGIN_HEADER,
+        )
+        assert resp.status_code == 403