fix(audit-wave-9): standardize on Sheet for previews; doctrine in CLAUDE.md

Swap the one outlier (client-interests-tab.tsx) from Vaul Drawer to
Sheet side=right so every detail-preview surface uses the same
primitive. Document the doctrine: Sheet for side panels on both desktop
and mobile; Vaul Drawer reserved for mobile-only bottom-sheet UX
(currently just MoreSheet).

Closes ui/ux M11.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/api/helpers.ts

@@ -389,3 +389,54 @@ export function withRateLimit(name: RateLimiterName, handler: RouteHandler): Rou
     return handler(req, ctx, params);
   };
 }
+
+// ─── withPublicContext ───────────────────────────────────────────────────────
+
+/**
+ * Wraps a public (unauthenticated) route — webhooks, health checks,
+ * public APIs — so it runs inside the same `runWithRequestContext` ALS
+ * frame that `withAuth` installs for authenticated routes. Without this
+ * frame, `captureErrorEvent`, `getRequestId`, and the logger's request-id
+ * mixin silently no-op for these endpoints, leaving webhook failures
+ * invisible in the platform-errors dashboard.
+ *
+ * Top-level errors thrown by the handler are forwarded to
+ * `captureErrorEvent` (so they surface in admin/errors) and re-raised
+ * so Next's runtime can return a 500. Webhook handlers that prefer to
+ * always-return-200 can catch internally — this wrapper only catches the
+ * uncaught path.
+ */
+export function withPublicContext(
+  handler: (req: NextRequest) => Promise<NextResponse>,
+): (req: NextRequest) => Promise<NextResponse> {
+  return async (req) => {
+    const incomingId = req.headers.get('x-request-id');
+    const requestId =
+      incomingId && /^[A-Za-z0-9-]{8,64}$/.test(incomingId) ? incomingId : randomUUID();
+    const tag = (res: NextResponse): NextResponse => {
+      res.headers.set('X-Request-Id', requestId);
+      return res;
+    };
+
+    return runWithRequestContext(
+      {
+        requestId,
+        portId: '',
+        userId: '',
+        method: req.method,
+        path: new URL(req.url).pathname,
+        startedAt: Date.now(),
+      },
+      async () => {
+        try {
+          return tag(await handler(req));
+        } catch (error) {
+          const { captureErrorEvent } = await import('@/lib/services/error-events.service');
+          void captureErrorEvent({ statusCode: 500, error });
+          logger.error({ err: error }, 'Public route handler threw');
+          return tag(errorResponse(error));
+        }
+      },
+    );
+  };
+}