Review safe-polish: docs accuracy, dead imports, no-emoji, geenforce robustness

From the full multi-agent review (0 high, 7 medium, 17 low findings). Applies
the mechanical, low-risk items; design/policy findings left for a decision.

Docs accuracy: CLAUDE.md contract 0.10.0 -> 0.11.0 and both stale Alembic head
citations -> 7d24_customfield_searchable / 31 migrations; Dockerfile bundled-
plugin comment fixed (drop nonexistent "equipment", add machines +
measuringtools, count eleven).

Style/naming (LOCKED rules): remove a CSS-escaped pushpin emoji before location
search results (no-emoji policy); rename ManifestEditor shareRoot -> shareroot
(variable mirrors the API field verbatim).

Dead code: remove confirmed-unused imports across ~20 modules (require_role/
require_permission scaffold residue, stray db/Vendor/Model/current_user/Optional/
error_response); drop unused build_scope import + a stale GEENFORCE_API_KEY
docstring clause in geenforce. Migration files left untouched.

Correctness: geenforce ingest robustness - record_enforcement_report now 400s
on a non-dict counts / non-list results instead of 500; _apply_app_link ignores
a non-numeric appid per its docstring instead of 500. Regression tests added.

Backend query.get sweep finished: auth.py refresh -> db.session.get (last one).

910 backend tests pass; pyflakes clean; naming green; frontend build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/views/SearchResults.vue

@@ -464,10 +464,6 @@ watch(results, () => {
   color: var(--text-light);
 }
 
-.result-location::before {
-  content: '\1F4CD ';
-}
-
 .result-ticket {
   font-family: monospace;
   font-size: 0.75rem;

frontend/src/views/geenforce/ManifestEditor.vue

@@ -36,7 +36,7 @@
       <div class="setting-row full-width">
         <label>
           <span>On-share export root</span>
-          <input v-model="shareRoot" placeholder="\\server\share\dt\shopfloor or /path" />
+          <input v-model="shareroot" placeholder="\\server\share\dt\shopfloor or /path" />
           <small class="input-hint">
             Used by Export to Share. During Milestone 1 the engine still reads
             these files; export is your push to the fleet.
@@ -587,7 +587,7 @@ const selectedId = ref(null)
 const detail = ref(null)
 const error = ref('')
 const notice = ref('')
-const shareRoot = ref('')
+const shareroot = ref('')
 
 // Phase-aware editing: the PREINSTALL runner implements only MSI/EXE types and
 // Registry/File detection (other types/detections are silently skipped there),
@@ -637,11 +637,11 @@ async function loadScopes() {
   } catch (e) { error.value = 'Failed to load PC types' }
 }
 async function loadConfig() {
-  try { shareRoot.value = payload(await api.get('/geenforce/config')).shareroot } catch (e) { /* optional */ }
+  try { shareroot.value = payload(await api.get('/geenforce/config')).shareroot } catch (e) { /* optional */ }
 }
 async function saveConfig() {
   try {
-    await api.put('/geenforce/config', { shareroot: shareRoot.value })
+    await api.put('/geenforce/config', { shareroot: shareroot.value })
     flash('Share root saved.')
   } catch (e) { error.value = 'Failed to save share root' }
 }