fix: close four small gaps around the record surface

The privacy dashboard re-implemented the audit-retention resolver with its own
default and its own floor. Two implementations of one disclosure, quoted to the
same person on two pages and by the purge job; it uses the shared resolver now.

The record-content branch in the settings gate matched a classification rather
than a page, so a second manage-writable destination would have rendered the
allergy and family-history managers under its own heading without anybody
choosing that. It resolves through a slug map, and the contract test fails if
the map and the classification disagree in either direction — a destination
cannot join the kind without somebody deciding what it renders.

The managed-profile nav filter assumed a guardian grant is always manage. It is
today, which is why the check was easy to leave out; an entry below that level
would have listed destinations the gate refuses.

Interpolation used a replacement string, and String.replace reads $&, $`, $',
$1 and $$ out of one. A display name containing $' rewrote the sentence around
it — and display names land in exactly the sentences that say who did what in
somebody's health record. A replacer function has no $ grammar at all, which
removes the class rather than escaping the members of it somebody thought of.

src/components/settings/settings-shell.tsx

@@ -460,10 +460,17 @@ export function SettingsShell({
       ? allVisibleSections
       : allVisibleSections.filter((section) => {
           const kind = classifySettingsDestination(section.slug).kind;
+          // Every destination on either list needs MANAGE, so the level is
+          // checked once for both record kinds rather than only for the adult
+          // one. A guardian grant is always MANAGE today, which is exactly why
+          // the check was easy to leave out — and a managed entry that ever
+          // arrived below it would have listed destinations the section gate
+          // refuses, sending somebody to a page that explains it cannot open.
+          if (activeRecord.level !== "manage") return false;
           if (activeRecord.recordKind === "managed") {
             return kind === "managed-guardian" || kind === "manage-writable";
           }
-          return kind === "manage-writable" && activeRecord.level === "manage";
+          return kind === "manage-writable";
         });
   const activeSection = allVisibleSections.find(
     (section) => section.slug === activeSlug,