feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

Major interest workflow expansion driven by the rapid-fire UX session.

EOI / Contract / Reservation tabs replace the generic Documents tab when
the deal is at the relevant stage — workspace pattern with active-doc
hero, signing progress, paper-signed upload, and history strip. Stage-
conditional visibility wired through interest-tabs.tsx so the tab set
shrinks/expands as the deal moves through the pipeline.

Contact log: per-interaction structured log (channel/direction/summary/
optional follow-up reminder). New `interest_contact_log` table + service
+ tab UI (timeline with channel-coded icons + compose dialog).
auto-creates a reminder when followUpAt is set.

Berth Interest milestone: first milestone in the OverviewTab's pipeline
strip, completes the moment any berth is linked via the junction. Drives
the "have we captured what they want?" sanity check for general_interest
leads before they move to EOI.

Stage-conditional milestones: past phases collapse into a one-liner
strip, current phase expands, future phases hide behind a "Show
upcoming" toggle. Inline stage picker now defers reason capture to an
override-confirm view (only required for illegal transitions, not the
default flow).

Notes blob → threaded: dropped `interests.notes` column entirely; the
threaded `interest_notes` table is the single source of truth. Latest-
note teaser on Overview links into the dedicated Notes tab. Polymorphic
notes service gains aggregated client view (unions client + interest +
yacht notes with source chips and group-by-source toggle).

Berth interest list overhaul:
  - Configurable columns via ColumnPicker (18 toggleable, 5 default-on)
  - Natural-sort SQL ORDER BY on mooring number (A1, A2, A10 not A10, A2)
  - Per-letter row tinting via colored left-border accent + dot in cell
  - Documents tab merged Files (single attachments section)

Topbar improvements:
  - Always-visible back arrow on detail pages (path depth > 2)
  - Breadcrumb-hint store + useBreadcrumbHint hook so detail pages can
    push their entity hierarchy (Clients › Mary Smith › Interest › B17)
  - Tighter spacing, softer separators, 160px crumb truncation

DataTable upgrades:
  - Page-size selector with All option (validator cap raised to 1000)
  - getRowClassName slot for per-row styling (used by berth tinting)
  - Fixed Radix SelectItem crash on empty-string values via __any__
    sentinel (was crashing every list page that opened a select filter)

Interest list:
  - Configurable columns picker
  - Stage cell clickable into detail
  - TagPicker + SavedViewsDropdown sized h-8 to match adjacent buttons
  - Save view moved into ColumnPicker menu; Views button hidden when
    no views are saved
  - Pipeline kanban board endpoint at /api/v1/interests/board with
    minimal projection, 5000-row cap + truncated banner, filter
    pass-through

Mobile chrome + sidebar collapse removed (always-expanded design choice).

User management lists super-admins (was inner-joined on user_port_roles
which excluded global super-admins).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/public/interests/route.ts

@@ -225,7 +225,6 @@ export async function POST(req: NextRequest) {
           yachtId,
           source: 'website',
           pipelineStage: 'open',
-          notes: data.notes,
         })
         .returning();
 

src/app/api/v1/clients/[id]/activity/route.ts

@@ -4,11 +4,14 @@ import { eq, and } from 'drizzle-orm';
 import { withAuth, withPermission } from '@/lib/api/helpers';
 import { db } from '@/lib/db';
 import { clients } from '@/lib/db/schema/clients';
-import { loadEntityActivity } from '@/lib/services/entity-activity.service';
+import {
+  loadClientActivityAggregated,
+  loadEntityActivity,
+} from '@/lib/services/entity-activity.service';
 import { errorResponse, NotFoundError } from '@/lib/errors';
 
 export const GET = withAuth(
-  withPermission('clients', 'view', async (_req, ctx, params) => {
+  withPermission('clients', 'view', async (req, ctx, params) => {
     try {
       const id = params.id;
       if (!id) throw new NotFoundError('client');
@@ -18,11 +21,19 @@ export const GET = withAuth(
         .where(and(eq(clients.id, id), eq(clients.portId, ctx.portId)))
         .limit(1);
       if (exists.length === 0) throw new NotFoundError('client');
-      const data = await loadEntityActivity({
-        portId: ctx.portId,
-        entityType: 'client',
-        entityId: id,
-      });
+      // ?aggregate=false opts out for callers that need just the
+      // client-level audit log (no interest events). Default is on
+      // since the Client overview Activity tab benefits from the
+      // full timeline.
+      const url = new URL(req.url);
+      const aggregate = url.searchParams.get('aggregate') !== 'false';
+      const data = aggregate
+        ? await loadClientActivityAggregated({ portId: ctx.portId, clientId: id })
+        : await loadEntityActivity({
+            portId: ctx.portId,
+            entityType: 'client',
+            entityId: id,
+          });
       return NextResponse.json({ data });
     } catch (error) {
       return errorResponse(error);

src/app/api/v1/clients/[id]/notes/route.ts

@@ -9,11 +9,18 @@ import { createNoteSchema } from '@/lib/validators/notes';
 import * as notesService from '@/lib/services/notes.service';
 
 export const GET = withAuth(
-  withPermission('clients', 'view', async (_req, ctx, params) => {
+  withPermission('clients', 'view', async (req, ctx, params) => {
     try {
       const clientId = params.id;
       if (!clientId) throw new NotFoundError('Client');
-      const notes = await notesService.listForEntity(ctx.portId, 'clients', clientId);
+      // ?aggregate=true unions client-level notes with notes from
+      // every interest + directly-owned yacht so the Notes tab on
+      // the client overview shows the full timeline.
+      const url = new URL(req.url);
+      const aggregate = url.searchParams.get('aggregate') === 'true';
+      const notes = aggregate
+        ? await notesService.listForClientAggregated(ctx.portId, clientId)
+        : await notesService.listForEntity(ctx.portId, 'clients', clientId);
       return NextResponse.json({ data: notes });
     } catch (error) {
       return errorResponse(error);

src/app/api/v1/contact-log/[id]/route.ts

@@ -0,0 +1,36 @@
+import { NextResponse } from 'next/server';
+
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { parseBody } from '@/lib/api/route-helpers';
+import { errorResponse } from '@/lib/errors';
+import { remove, update } from '@/lib/services/interest-contact-log.service';
+import { updateContactLogSchema } from '@/lib/validators/interest-contact-log';
+
+export const PATCH = withAuth(
+  withPermission('interests', 'edit', async (req, ctx, params) => {
+    try {
+      const body = await parseBody(req, updateContactLogSchema);
+      const entry = await update(params.id!, ctx.portId, ctx.userId, {
+        occurredAt: body.occurredAt,
+        channel: body.channel,
+        direction: body.direction,
+        summary: body.summary,
+        followUpAt: body.followUpAt,
+      });
+      return NextResponse.json({ data: entry });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);
+
+export const DELETE = withAuth(
+  withPermission('interests', 'edit', async (_req, ctx, params) => {
+    try {
+      await remove(params.id!, ctx.portId);
+      return NextResponse.json({ ok: true });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);

src/app/api/v1/interests/[id]/contact-log/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server';
+
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { parseBody } from '@/lib/api/route-helpers';
+import { errorResponse } from '@/lib/errors';
+import { create, listForInterest } from '@/lib/services/interest-contact-log.service';
+import { createContactLogSchema } from '@/lib/validators/interest-contact-log';
+
+export const GET = withAuth(
+  withPermission('interests', 'view', async (_req, ctx, params) => {
+    try {
+      const entries = await listForInterest(params.id!, ctx.portId);
+      return NextResponse.json({ data: entries });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);
+
+export const POST = withAuth(
+  withPermission('interests', 'edit', async (req, ctx, params) => {
+    try {
+      const body = await parseBody(req, createContactLogSchema);
+      const entry = await create(ctx.userId, {
+        interestId: params.id!,
+        occurredAt: body.occurredAt,
+        channel: body.channel,
+        direction: body.direction,
+        summary: body.summary,
+        followUpAt: body.followUpAt ?? null,
+      });
+      return NextResponse.json({ data: entry }, { status: 201 });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);

src/app/api/v1/interests/[id]/eoi-context/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { errorResponse } from '@/lib/errors';
+import { buildEoiContext } from '@/lib/services/eoi-context';
+
+/**
+ * Returns the resolved `EoiContext` — the actual data that would be
+ * auto-filled into the EOI document — for the given interest. Drives
+ * the EOI generate dialog's pre-flight preview so a sales rep can see
+ * (and correct) every value before sending the document for signing.
+ *
+ * No mutation; pure read of denormalized data the EOI builder already
+ * computes server-side. Returns 404 if the interest is missing or in
+ * another port (the buildEoiContext function throws NotFoundError).
+ */
+export const GET = withAuth(
+  withPermission('interests', 'view', async (_req, ctx, params) => {
+    try {
+      const context = await buildEoiContext(params.id!, ctx.portId);
+      return NextResponse.json({ data: context });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);

src/app/api/v1/interests/board/route.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server';
+
+import { withAuth, withPermission } from '@/lib/api/helpers';
+import { parseQuery } from '@/lib/api/route-helpers';
+import { errorResponse } from '@/lib/errors';
+import { listInterestsForBoard } from '@/lib/services/interests.service';
+import { boardFiltersSchema } from '@/lib/validators/interests';
+
+/**
+ * Board (kanban) endpoint — returns every active interest for the port
+ * with a minimal projection (id, clientName, mooring, leadCategory,
+ * stage, updatedAt). No pagination: the kanban renders the whole
+ * pipeline at once. The service hard-caps at 5000 rows to keep payload
+ * size bounded; if `truncated: true` the UI surfaces a banner.
+ *
+ * Filter params are a strict subset of the list endpoint — see
+ * boardFiltersSchema. `pipelineStage` and `includeArchived` are
+ * intentionally rejected at validation time.
+ */
+export const GET = withAuth(
+  withPermission('interests', 'view', async (req, ctx) => {
+    try {
+      const filters = parseQuery(req, boardFiltersSchema);
+      const result = await listInterestsForBoard(ctx.portId, filters);
+      return NextResponse.json(result);
+    } catch (error) {
+      return errorResponse(error);
+    }
+  }),
+);

src/app/api/v1/me/route.ts

@@ -30,12 +30,34 @@ const updateProfileSchema = z.object({
       dark_mode: z.boolean().optional(),
       locale: z.string().optional(),
       timezone: z.string().optional(),
+      // Per-table column visibility. Keyed by entity type — entries
+      // with an empty `hiddenColumns` mean "all visible". The validator
+      // caps total entries / IDs so a malicious client can't bloat the
+      // 8 KB preferences blob; see merge step below for the byte cap.
+      tablePreferences: z
+        .record(
+          z.string().min(1).max(64),
+          z
+            .object({
+              hiddenColumns: z.array(z.string().min(1).max(64)).max(50).optional(),
+            })
+            .strict(),
+        )
+        .optional(),
     })
     .strict()
     .optional(),
 });
 
 export const GET = withAuth(async (_req, ctx: AuthContext) => {
+  // Hydrate preferences from user_profiles so the client can read its
+  // saved table-column visibility (and other prefs) without a second
+  // round-trip on app boot.
+  const profile = await db.query.userProfiles.findFirst({
+    where: eq(userProfiles.userId, ctx.userId),
+    columns: { preferences: true, avatarFileId: true, avatarUrl: true },
+  });
+
   return NextResponse.json({
     data: {
       userId: ctx.userId,
@@ -44,6 +66,11 @@ export const GET = withAuth(async (_req, ctx: AuthContext) => {
       permissions: ctx.permissions,
       isSuperAdmin: ctx.isSuperAdmin,
       user: ctx.user,
+      preferences: profile?.preferences ?? {},
+      profile: {
+        avatarFileId: profile?.avatarFileId ?? null,
+        avatarUrl: profile?.avatarUrl ?? null,
+      },
     },
   });
 });
@@ -67,7 +94,7 @@ export const PATCH = withAuth(async (req, ctx: AuthContext) => {
       // .passthrough(); the merge prunes them so legacy bloat doesn't
       // accumulate forever, and a future schema regression that tries
       // to ship arbitrary keys still gets dropped here at write time.
-      const ALLOWED_PREF_KEYS = new Set(['dark_mode', 'locale', 'timezone']);
+      const ALLOWED_PREF_KEYS = new Set(['dark_mode', 'locale', 'timezone', 'tablePreferences']);
       const existing = (profile.preferences as Record<string, unknown>) ?? {};
       const merged = Object.fromEntries(
         Object.entries({ ...existing, ...body.preferences }).filter(([k]) =>