fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/auth/permission-tabs.integration.test.ts

@@ -1,19 +1,18 @@
 import { describe, expect, it } from 'vitest';
 import { filterTabsByPermission } from './permission-tabs';
 
-describe('permission-aware tabs', () => {
-  const tabs = [
-    { key: 'all', requiredPermission: 'deposit:view' },
-    { key: 'pending', requiredPermission: 'deposit:approve' },
-  ];
+const tabs = [
+  { key: 'records', requiredPermission: 'deposit:view' },
+  { key: 'refund', requiredPermission: 'deposit:refund' },
+];
 
-  it('hides tabs whose backing API permission is missing', () => {
-    expect(filterTabsByPermission(tabs, ['deposit:view']).map((tab) => tab.key)).toEqual(['all']);
-  });
-
-  it('shows a privileged tab only when its permission is present', () => {
+describe('permission tabs', () => {
+  it('shows only tabs allowed by exact permissions', () => {
+    expect(filterTabsByPermission(tabs, ['deposit:view']).map((tab) => tab.key)).toEqual([
+      'records',
+    ]);
     expect(
-      filterTabsByPermission(tabs, ['deposit:view', 'deposit:approve']).map((tab) => tab.key),
-    ).toEqual(['all', 'pending']);
+      filterTabsByPermission(tabs, ['deposit:view', 'deposit:refund']).map((tab) => tab.key),
+    ).toEqual(['records', 'refund']);
   });
 });