fix(uat): batch — timeline overshoot, name-sync, reset-password, dashboard cleanup, queue/seed hygiene + alpha UAT findings doc

UAT findings landed across the last few Playwright + React Grab passes;
single grouped commit so the index doesn't fragment into 30 one-liners.

User & auth:
- `user-settings`: name now updates the avatar + topbar menu after save
  (was reading stale session).
- `me/password-reset`: 3 bugs (token validation, error response shape,
  redirect chain).
- Admin user permission-overrides route honours the same envelope as
  the rest of the admin surface.

Dashboard:
- Removed obsolete `revenue-breakdown-chart` + `dashboard-widgets-card`
  (replaced by the customisable widget grid).
- Strip `revenue_breakdown` from analytics route + use-analytics +
  service + integration test so nothing renders an empty card.
- Activity log timeline overshoot fix (`interest-timeline` +
  `entity-activity-feed`).
- Tightened tiles: active-deals, berth-heat-widget, pipeline-value, kpi-tile.
- `dev-mode-banner`: derive dismissed state synchronously instead of
  via an effect (set-state-in-effect lint rule).

Forms & lists (assorted polish):
- client / company / yacht / interest / reminder forms — validation +
  empty-state copy + tab transitions.
- companies/yachts list tweaks; berth recommender panel; qualification
  checklist; supplemental info request button.

Infra & misc:
- Queue workers (ai / email / notifications) — log shape +
  per-job timeout consistency.
- Auth / brochures / users schema small adjustments; seeds reflect
  permissions matrix changes.
- Scan shell + scanner manifest + AI admin page small fixes.
- `next.config.transpilePackages` adds `echarts`/`zrender`/`echarts-for-react`
  (recommended config from echarts-for-react inside Next).

Docs:
- `docs/superpowers/audits/alpha-uat-master.md` — single rolling
  cross-cutting UAT findings doc (per CLAUDE.md convention).
- `docs/BACKLOG.md`: dashboard stats cards (§I) + activity-log
  normalization (§J).
- 2026-05-18 audit log updated with this batch.
- `CLAUDE.md` — small manual UAT scaffold notes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/admin/roles/role-form.tsx

@@ -32,7 +32,13 @@ const DEFAULT_PERMISSIONS: Record<string, Record<string, boolean>> = {
     generate_eoi: false,
     export: false,
   },
-  berths: { view: false, edit: false, import: false, manage_waiting_list: false },
+  berths: {
+    view: false,
+    edit: false,
+    import: false,
+    manage_waiting_list: false,
+    update_prices: false,
+  },
   documents: {
     view: false,
     create: false,

src/components/admin/settings/settings-manager.tsx

@@ -104,7 +104,7 @@ const KNOWN_SETTINGS: Array<{
     description:
       'Reply-to email shown in client confirmation emails when a new interest is registered',
     type: 'string',
-    defaultValue: 'sales@portnimara.com',
+    defaultValue: '',
   },
   {
     key: 'inquiry_notification_recipients',
@@ -129,8 +129,8 @@ const KNOWN_SETTINGS: Array<{
       'Internal staff who countersign every EOI. JSON object with `developer` (signs after the client) and `approver` (final approval). Both fields take `{ name, email }`.',
     type: 'json',
     defaultValue: {
-      developer: { name: 'David Mizrahi', email: 'dm@portnimara.com' },
-      approver: { name: 'Abbie May', email: 'sales@portnimara.com' },
+      developer: { name: '', email: '' },
+      approver: { name: '', email: '' },
     },
   },
   // ─── Berth recommender (src/lib/services/berth-recommender.service.ts) ──────

src/components/admin/users/user-permission-matrix.tsx

@@ -67,7 +67,7 @@ const PERMISSION_LEAVES: Record<string, string[]> = {
     'generate_eoi',
     'export',
   ],
-  berths: ['view', 'edit', 'import', 'manage_waiting_list'],
+  berths: ['view', 'edit', 'import', 'manage_waiting_list', 'update_prices'],
   documents: [
     'view',
     'create',