Security recovery: hold sweep, dashboard updates, and admin fixes.

frontend/src/app/(public)/dashboard/components/_shared/status.tsx

@@ -9,12 +9,14 @@ import type { UserTicket, Payment } from '@/lib/api';
 //   unpaid     -> pale red
 //   attended   -> pale blue   (replaces the raw "checked_in" value)
 //   cancelled  -> pale gray
+//   onHold     -> pale slate  (spot released after the payment deadline passed)
 export type DashStatus =
   | 'confirmed'
   | 'awaiting'
   | 'unpaid'
   | 'attended'
-  | 'cancelled';
+  | 'cancelled'
+  | 'onHold';
 
 /**
  * Collapse a ticket status + payment status into a single user-facing status.
@@ -26,6 +28,7 @@ export function deriveTicketStatus(
 ): DashStatus {
   if (ticketStatus === 'checked_in') return 'attended';
   if (ticketStatus === 'cancelled') return 'cancelled';
+  if (ticketStatus === 'on_hold' || paymentStatus === 'on_hold') return 'onHold';
   if (paymentStatus === 'paid' || ticketStatus === 'confirmed') return 'confirmed';
   if (paymentStatus === 'pending_approval') return 'awaiting';
   return 'unpaid';
@@ -35,6 +38,7 @@ export function deriveTicketStatus(
 export function derivePaymentStatus(paymentStatus?: string): DashStatus {
   if (paymentStatus === 'paid') return 'confirmed';
   if (paymentStatus === 'pending_approval') return 'awaiting';
+  if (paymentStatus === 'on_hold') return 'onHold';
   if (paymentStatus === 'refunded') return 'cancelled';
   return 'unpaid';
 }
@@ -46,6 +50,7 @@ export function statusLabel(status: DashStatus, locale: string): string {
     unpaid: { en: 'Unpaid', es: 'No pagado' },
     attended: { en: 'Attended', es: 'Asistió' },
     cancelled: { en: 'Cancelled', es: 'Cancelado' },
+    onHold: { en: 'On Hold', es: 'En Espera' },
   };
   return locale === 'es' ? labels[status].es : labels[status].en;
 }
@@ -56,6 +61,7 @@ const PILL_STYLES: Record<DashStatus, string> = {
   unpaid: 'bg-red-100 text-red-700',
   attended: 'bg-blue-100 text-blue-800',
   cancelled: 'bg-gray-100 text-gray-600',
+  onHold: 'bg-slate-100 text-slate-600',
 };
 
 export function StatusPill({