fix(security): close member self-escalation + harden after full audit

Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:

- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
  extend prevent_member_self_role_change to also block a
  non-privileged member changing their own tier_id (self tier
  upgrade) and onboarding_completed_at (skipping required
  code-of-conduct via a raw PostgREST call). finishOnboarding and
  skipOnboarding now set onboarding_completed_at through the service
  client AFTER their server-side required-steps check, so the
  legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
  to updateForumThread, deleteForumThread, editComment, deleteComment,
  deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
  (was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
  (no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
  integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).

Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).

271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.

lib/actions/onboarding.ts

@@ -2,6 +2,7 @@
 
 import { revalidatePath } from 'next/cache'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import { requireMember, requireMemberWithRole, parseInput } from '@/lib/auth-helpers'
 import {
   createOnboardingStepSchema,
@@ -173,10 +174,16 @@ export async function finishOnboarding() {
     return { error: 'Please complete the required steps before finishing.' }
   }
 
-  const { error } = await supabase
+  // onboarding_completed_at is blocked by the self-change trigger (migration
+  // 024) so a member cannot skip required steps via a raw PostgREST call.
+  // Set it via the service client AFTER the required-steps check above, scoped
+  // to this member's own id.
+  const admin = createAdminClient()
+  const { error } = await admin
     .from('space_members')
     .update({ onboarding_completed_at: new Date().toISOString() })
     .eq('id', member.id)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   revalidatePath('/dashboard')
@@ -201,10 +208,12 @@ export async function skipOnboarding() {
     return { error: 'This space requires you to complete onboarding.' }
   }
 
-  const { error } = await supabase
+  const admin = createAdminClient()
+  const { error } = await admin
     .from('space_members')
     .update({ onboarding_completed_at: new Date().toISOString() })
     .eq('id', member.id)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   revalidatePath('/dashboard')