fix(sanity): resolve 15 gaps from sanity check audit (G-01 through G-15)

- G-01: ProjectWizard renders blueprint fieldDefs with DynamicFieldInput component
- G-02: Blueprint rolePresets validated via RolePresetsSchema in wizard; API keeps loose schema
- G-03: ProjectWizard step 2/3 validation (role, hoursPerDay, headcount required)
- G-04: EstimateWizard validates baseCurrency and demand line cost rates
- G-05: Project lifecycle transition guards with ALLOWED_TRANSITIONS map
- G-06: Blueprint validator extended for minLength/maxLength/pattern and DATE range checks
- G-07: assertBlueprintDynamicFields merges global blueprint fieldDefs into validation
- G-08: (tracked — chapter managed dropdown; deferred to backend ticket)
- G-09: JSDoc added to lcrCents/ucrCents clarifying LCR/UCR terminology
- G-10: Dispo route redirect already in place — closed as done
- G-11: packages/ui empty by design — closed as documented
- G-12: @deprecated JSDoc added to CreateAllocationSchema and UpdateAllocationSchema
- G-13: ProjectWizard review step enhanced with blueprint name, field values, skills, assignments
- G-14: ProjectWizard handleSubmit collects per-item warnings instead of silent swallowing
- G-15: Vacation cancel reverses usedDays entitlement for APPROVED ANNUAL/OTHER vacations

Tests: all 1575 passing (1 pre-existing failure in insights-summary unrelated to these changes)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/__tests__/vacation-router.test.ts

@@ -163,9 +163,12 @@ function createVacationDb(overrides: Record<string, unknown> = {}) {
     auditLog: {
       create: vi.fn().mockResolvedValue({}),
     },
+    vacationEntitlement: {
+      updateMany: vi.fn().mockResolvedValue({ count: 0 }),
+    },
   };
 
-  return {
+  const merged = {
     ...db,
     ...overrides,
     user: { ...db.user, ...(overrides.user as Record<string, unknown> | undefined) },
@@ -176,6 +179,15 @@ function createVacationDb(overrides: Record<string, unknown> = {}) {
       ...(overrides.notification as Record<string, unknown> | undefined),
     },
     auditLog: { ...db.auditLog, ...(overrides.auditLog as Record<string, unknown> | undefined) },
+    vacationEntitlement: {
+      ...db.vacationEntitlement,
+      ...(overrides.vacationEntitlement as Record<string, unknown> | undefined),
+    },
+  };
+
+  return {
+    ...merged,
+    $transaction: vi.fn(async (callback: (tx: typeof merged) => Promise<unknown>) => callback(merged)),
   };
 }