fix: Phase 2 QA — all 25 remaining HIGH/MEDIUM/LOW issues

HIGH fixes (7):
- H1: VNCdirectory admin i18n — 30+ translation keys added
- H2: handleSave try/catch with error toast
- H3: Free/busy accountId scoping
- H4: cancelEventBookings filter by eventId
- H5: Resource picker static apiFetch import
- H6: Sharing-store toast messages via lastMessage state
- H7: roleLabel for all resource types

MEDIUM fixes (11):
- M1: identitySignatureMap cleanup on delete
- M2: Now-line relative positioning
- M3: Radial menu disabled item keyboard nav
- M4: Radial menu stable event listener via refs
- M5: cancelBooking error on missing booking
- M6: PasswordRow isMasked state flag
- M7: Extract shared rights into lib/sharing-rights.ts
- M8: VNCtalk client server-side guard
- M9: Collabora configManager instead of process.env
- M10: CONFIG_ENV_MAP VNCdirectory fields
- M11: SENSITIVE_CONFIG_KEYS field name unification

LOW fixes (7):
- L1-L3: Unused imports removed
- L4: aria-labels on close, clear, search, spinner
- L5-L7: Comments for intentional patterns, null guard

lib/collabora/client.ts

@@ -79,8 +79,10 @@ export async function getCollaboraEditUrl(
 
   // For now, return the base edit URL. A full WOPI implementation would
   // generate a WOPI src URL with an access token pointing back to this server.
+  const appUrl = configManager.get<string>("appUrl") || process.env.NEXT_PUBLIC_APP_URL;
+  const port = configManager.get<string>("port") || process.env.PORT || "3000";
   const wopiSrcUrl = `${actionUrl}?WOPISrc=${encodeURIComponent(
-    `${process.env.NEXT_PUBLIC_APP_URL || `http://localhost:${process.env.PORT || 3000}`}/api/collabora/wopi/files/${encodeURIComponent(fileId)}`
+    `${appUrl || `http://localhost:${port}`}/api/collabora/wopi/files/${encodeURIComponent(fileId)}`
   )}`;
 
   return wopiSrcUrl;