What pitfalls or common mistakes should I be aware of before implementing this? Anything administrative, implementation-specific, or platform-specific?
A few that spring to mind.
There are two key exchange algorithms used in forward secrecy TLS. DHE and ECDHE. To get forward secrecy with the widest range of clients you need to support both. You should generally preffered ECDHE over DHE because it performs better and for compatibility with Java 7 (see below).
Making forward secrecy mandatory will exclude Internet Explorer (any version) on windows XP. I expect the same will be true of anything that uses the windows built in SSL/TLS stack on XP.
For DHE you need to make sure you use strong dh parameters. You should use custom generated dh parameters with at least a 2048 bit prime (the security of a dh prime is comparable to a RSA key of the same length).
Java 6 and 7 break if you negotiate a DHE ciphersuite and use DH parameters larger than 1024 bit. This is a particulally acutute issue with java 6 as it does not support ECDHE.
Prior to making PFS mandatory on our server, I would like to account for and prepare for the incompatibilities.
One option could be to make the forward secrecy ciphersuites preffered but not mandatory and set up your server to log what ciphersuite is used for each connection. You can then look at your logs and determine how many clients you would lose if you mandated forward secrecy.
Are there misconceptions regarding what PFS can and can't do? Could our Audit department need a reality check?
Basically what forward secrecy does is prevent someone who stole your key using it to passively decrypt traffic. In particular without forward secrecy someone who has been monitoring and storing your traffic and later steals your key can go back and decrypt the traffic they captured previously.
What forward secrecy will not do is prevent someone who stole your key from using it to impersonate you (and either act as a man in the middle or replace your server with theirs).
Forward secrecy will not help you if the symetric encryption is broken. The cryptography used for the forward secrecy key exchange could also potentially be broken (see the comment about above dh parameters).
Are the benefits of PFS limited by application? (web vs smtp, etc)
The benefits are the same but you may well find that support in clients is not as common.