fix(uat): batch — timeline overshoot, name-sync, reset-password, dashboard cleanup, queue/seed hygiene + alpha UAT findings doc

UAT findings landed across the last few Playwright + React Grab passes;
single grouped commit so the index doesn't fragment into 30 one-liners.

User & auth:
- `user-settings`: name now updates the avatar + topbar menu after save
  (was reading stale session).
- `me/password-reset`: 3 bugs (token validation, error response shape,
  redirect chain).
- Admin user permission-overrides route honours the same envelope as
  the rest of the admin surface.

Dashboard:
- Removed obsolete `revenue-breakdown-chart` + `dashboard-widgets-card`
  (replaced by the customisable widget grid).
- Strip `revenue_breakdown` from analytics route + use-analytics +
  service + integration test so nothing renders an empty card.
- Activity log timeline overshoot fix (`interest-timeline` +
  `entity-activity-feed`).
- Tightened tiles: active-deals, berth-heat-widget, pipeline-value, kpi-tile.
- `dev-mode-banner`: derive dismissed state synchronously instead of
  via an effect (set-state-in-effect lint rule).

Forms & lists (assorted polish):
- client / company / yacht / interest / reminder forms — validation +
  empty-state copy + tab transitions.
- companies/yachts list tweaks; berth recommender panel; qualification
  checklist; supplemental info request button.

Infra & misc:
- Queue workers (ai / email / notifications) — log shape +
  per-job timeout consistency.
- Auth / brochures / users schema small adjustments; seeds reflect
  permissions matrix changes.
- Scan shell + scanner manifest + AI admin page small fixes.
- `next.config.transpilePackages` adds `echarts`/`zrender`/`echarts-for-react`
  (recommended config from echarts-for-react inside Next).

Docs:
- `docs/superpowers/audits/alpha-uat-master.md` — single rolling
  cross-cutting UAT findings doc (per CLAUDE.md convention).
- `docs/BACKLOG.md`: dashboard stats cards (§I) + activity-log
  normalization (§J).
- 2026-05-18 audit log updated with this batch.
- `CLAUDE.md` — small manual UAT scaffold notes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/scan/scan-shell.tsx

@@ -5,9 +5,6 @@ import Image from 'next/image';
 import { useRouter } from 'next/navigation';
 import { Camera, Loader2, RotateCcw, AlertTriangle, CheckCircle2, Save } from 'lucide-react';
 
-const LOGO_URL =
-  'https://s3.portnimara.com/images/Port%20Nimara%20New%20Logo-Circular%20Frame_250px.png';
-
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
@@ -322,7 +319,15 @@ function VerifyForm({
 
 // ─── Shell ────────────────────────────────────────────────────────────────────
 
-export function ScanShell() {
+interface ScanShellProps {
+  /** Per-port brand logo resolved server-side by the page wrapper.
+   *  Null hides the logo block — we never fall back to another tenant's
+   *  imagery. */
+  logoUrl?: string | null;
+  portName?: string | null;
+}
+
+export function ScanShell({ logoUrl, portName }: ScanShellProps = {}) {
   const router = useRouter();
   const portSlug = useUIStore((s) => s.currentPortSlug);
   const fileRef = useRef<HTMLInputElement>(null);
@@ -505,15 +510,17 @@ export function ScanShell() {
       {/* Brand header - logo centered, page title underneath. Establishes
           the standalone identity (this is the PWA home for the scanner). */}
       <header className="flex flex-col items-center gap-3">
-        <Image
-          src={LOGO_URL}
-          alt="Port Nimara"
-          width={64}
-          height={64}
-          className="rounded-full shadow-md"
-          priority
-          unoptimized
-        />
+        {logoUrl ? (
+          <Image
+            src={logoUrl}
+            alt={portName ?? 'Logo'}
+            width={64}
+            height={64}
+            className="rounded-full shadow-md"
+            priority
+            unoptimized
+          />
+        ) : null}
         <div className="flex w-full items-center justify-between">
           <h1 className="text-xl font-semibold">Scan a receipt</h1>
           {state.kind !== 'idle' ? (