fix: resolve frontend audit findings

Repair investment recovery, draft preservation, date validation,
currency presentation, accessibility, and route error recovery.
Correct Docker and dependency checks and consume explicit income roles.

src/shared/api/resource-query.ts

@@ -8,6 +8,7 @@ import {
 } from "@tanstack/react-query";
 import { useEffect } from "react";
 import { useAuthenticatedQuery } from "./authenticated-query";
+import { getAuthenticatedSessionSnapshot } from "./client";
 import type { components } from "./generated/schema";
 import { apiErrorCode } from "./problem-details";
 
@@ -107,8 +108,14 @@ function useResourceQuery<T extends Resource, E, K extends QueryKey>(
 	}, [client, group, query.error]);
 	const observe = async (expectedStateVersion?: string) => {
 		const queryFn = guarded;
-		if (typeof queryFn !== "function") return;
-		await client.cancelQueries({ queryKey: options.queryKey, exact: true });
+		if (
+			!query.isEnabled ||
+			!getAuthenticatedSessionSnapshot() ||
+			typeof queryFn !== "function"
+		)
+			return;
+		// Cancellation is synchronous; start the replacement in the same boundary.
+		void client.cancelQueries({ queryKey: options.queryKey, exact: true });
 		return client.fetchQuery({
 			...options,
 			staleTime: 0,
@@ -144,7 +151,11 @@ function useResourceQuery<T extends Resource, E, K extends QueryKey>(
 			},
 		});
 	};
-	return { ...unwrapResourceResult(query), observe };
+	return {
+		...unwrapResourceResult(query),
+		queryKey: options.queryKey,
+		observe,
+	};
 }
 
 export { invalidateResourceAccess, unwrapResourceResult, useResourceQuery };