fix(uat): batch — timeline overshoot, name-sync, reset-password, dashboard cleanup, queue/seed hygiene + alpha UAT findings doc

UAT findings landed across the last few Playwright + React Grab passes;
single grouped commit so the index doesn't fragment into 30 one-liners.

User & auth:
- `user-settings`: name now updates the avatar + topbar menu after save
  (was reading stale session).
- `me/password-reset`: 3 bugs (token validation, error response shape,
  redirect chain).
- Admin user permission-overrides route honours the same envelope as
  the rest of the admin surface.

Dashboard:
- Removed obsolete `revenue-breakdown-chart` + `dashboard-widgets-card`
  (replaced by the customisable widget grid).
- Strip `revenue_breakdown` from analytics route + use-analytics +
  service + integration test so nothing renders an empty card.
- Activity log timeline overshoot fix (`interest-timeline` +
  `entity-activity-feed`).
- Tightened tiles: active-deals, berth-heat-widget, pipeline-value, kpi-tile.
- `dev-mode-banner`: derive dismissed state synchronously instead of
  via an effect (set-state-in-effect lint rule).

Forms & lists (assorted polish):
- client / company / yacht / interest / reminder forms — validation +
  empty-state copy + tab transitions.
- companies/yachts list tweaks; berth recommender panel; qualification
  checklist; supplemental info request button.

Infra & misc:
- Queue workers (ai / email / notifications) — log shape +
  per-job timeout consistency.
- Auth / brochures / users schema small adjustments; seeds reflect
  permissions matrix changes.
- Scan shell + scanner manifest + AI admin page small fixes.
- `next.config.transpilePackages` adds `echarts`/`zrender`/`echarts-for-react`
  (recommended config from echarts-for-react inside Next).

Docs:
- `docs/superpowers/audits/alpha-uat-master.md` — single rolling
  cross-cutting UAT findings doc (per CLAUDE.md convention).
- `docs/BACKLOG.md`: dashboard stats cards (§I) + activity-log
  normalization (§J).
- 2026-05-18 audit log updated with this batch.
- `CLAUDE.md` — small manual UAT scaffold notes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/interests.service.ts

@@ -777,6 +777,16 @@ export async function createInterest(portId: string, data: CreateInterestInput,
     }),
   );
 
+  // Phase 6 — CRM → Umami attribution. Fire an inbound-lead event so
+  // marketing can correlate inquiry volume with website traffic by
+  // source / referrer.
+  void import('@/lib/services/umami.service').then(({ trackEvent }) =>
+    trackEvent(portId, 'interest-created', {
+      interestId: result.id,
+      source: result.source ?? null,
+    }),
+  );
+
   return result;
 }
 
@@ -1016,6 +1026,15 @@ export async function changeInterestStage(
     }),
   );
 
+  // Phase 6 — CRM → Umami attribution for pipeline movement.
+  void import('@/lib/services/umami.service').then(({ trackEvent }) =>
+    trackEvent(portId, 'interest-stage-changed', {
+      interestId: id,
+      oldStage: oldStage ?? null,
+      newStage: data.pipelineStage,
+    }),
+  );
+
   // Fire-and-forget notification to the acting user. Resolve a friendly
   // label (client full name → primary mooring number → "this interest") so
   // the inbox doesn't surface a raw UUID; stage names go through the
@@ -1216,6 +1235,18 @@ export async function setInterestOutcome(
   // via system_settings.berth_rules.
   void evaluateRule('interest_completed', id, portId, meta);
 
+  // Phase 6 — CRM → Umami attribution. Fire a custom Umami event so
+  // marketing can correlate inbound website traffic with the resulting
+  // deal outcome. Dynamic import to avoid a circular service dep at
+  // module-load time.
+  void import('@/lib/services/umami.service').then(({ trackEvent }) =>
+    trackEvent(portId, 'interest-outcome-set', {
+      interestId: id,
+      outcome: data.outcome,
+      stageAtOutcome,
+    }),
+  );
+
   return { ok: true as const };
 }