fix(security): close member self-escalation + harden after full audit

Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:

- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
  extend prevent_member_self_role_change to also block a
  non-privileged member changing their own tier_id (self tier
  upgrade) and onboarding_completed_at (skipping required
  code-of-conduct via a raw PostgREST call). finishOnboarding and
  skipOnboarding now set onboarding_completed_at through the service
  client AFTER their server-side required-steps check, so the
  legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
  to updateForumThread, deleteForumThread, editComment, deleteComment,
  deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
  (was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
  (no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
  integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).

Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).

271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.

app/(app)/layout.tsx

@@ -3,6 +3,10 @@ import { redirect } from 'next/navigation'
 import { AppSidebar } from '@/components/app-sidebar'
 import { getRoleLabelMap } from '@/lib/role-labels'
 
+// This layout is the auth/onboarding gate for the whole app. It must never be
+// statically cached: every request re-checks the session and member state.
+export const dynamic = 'force-dynamic'
+
 export default async function AppLayout({ children }: { children: React.ReactNode }) {
   const supabase = await createClient()
   const { data: { user } } = await supabase.auth.getUser()

app/(app)/settings/page.tsx

@@ -12,14 +12,18 @@ export default async function SettingsPage() {
 
   if (!member) redirect('/login')
 
+  // Settings is admin-only. Gate on the server BEFORE fetching space config
+  // and integration state so non-admins never receive it. Board/treasurer
+  // use /customize for the things they can change.
+  const isAdmin = member.role === 'admin'
+  if (!isAdmin) redirect('/dashboard')
+
   const { data: space } = await supabase
     .from('spaces').select('*').eq('id', member.space_id).single()
 
   const { data: integrations } = await supabase
     .from('integrations').select('*').eq('space_id', member.space_id)
 
-  const isAdmin = member?.role === 'admin'
-
   return (
     <SettingsClient
       space={space}

app/(app)/tasks/page.tsx

@@ -17,7 +17,7 @@ export default async function TasksPage() {
   if (!spaceId) return null
 
   const [{ data: tasks }, { data: members }, { data: areasRaw }] = await Promise.all([
-    supabase.from('tasks').select('*').eq('space_id', spaceId).order('created_at', { ascending: false }),
+    supabase.from('tasks').select('*').eq('space_id', spaceId).order('created_at', { ascending: false }).limit(2000),
     supabase.from('space_members').select('id, display_name, user_id').eq('space_id', spaceId).in('status', ['current', 'late']),
     supabase
       .from('space_areas')