feat(admin): inquiry inbox, send log, email-template overrides, reports dashboard, recommender keys, role-editor coverage; replace placeholder pages

Closes the bulk of audit-pass-#1 admin gaps in one batch.

New admin pages:
- /admin/inquiries reads website_submissions with filter chips for
  berth/residence/contact + payload viewer per row.
- /admin/sends reads document_sends with sent/failed filter chips and
  expandable body markdown; failures surface errorReason and any
  fallback-to-link reason from the SMTP retry.
- /admin/email-templates lets per-port admins override the subject of
  each transactional template (8 templates catalogued in
  template-catalog.ts). Body editing is a follow-on; portal_activation
  + portal_reset are wired to honor the override via loadSubjectOverride.
- /admin/reports replaces the "Coming in Layer 3" placeholder with a
  KPI dashboard: 4 KPI tiles, pipeline funnel bars, berth occupancy
  donut-bars, conversion %, refresh every 60s.
- backup/import/onboarding admin pages replace placeholders with
  actionable guidance: backup posture + planned features, available CLI
  imports + planned UI, ordered onboarding checklist linking to admin
  pages.

Existing pages widened:
- settings-manager exposes the 9 berth-recommender tunables that were
  previously code-only (recommender_*, heat_weight_*, fallthrough_*,
  tier_ladder_hide_late_stage).
- role-form covers all 19 RolePermissions schema groups; previously
  missing yachts/companies/memberships/reservations + missing
  documents.edit + files.edit checkboxes. snake_case residential
  labels replaced with friendly text.

portal-auth.service.ts now also writes audit_log rows for portal
invite, resend, activate, password-reset request, and reset (closes one
more audit-pass-#2 gap while we were touching the file).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/email/templates/portal-auth.ts

@@ -50,12 +50,20 @@ function shell(opts: { title: string; body: string }): string {
 </html>`;
 }
 
-export function activationEmail(data: ActivationData): {
+export function activationEmail(
+  data: ActivationData,
+  overrides?: { subject?: string | null },
+): {
   subject: string;
   html: string;
   text: string;
 } {
-  const subject = `Activate your ${data.portName} client portal account`;
+  const subject = overrides?.subject
+    ? overrides.subject
+        .replace(/\{\{portName\}\}/g, data.portName)
+        .replace(/\{\{recipientName\}\}/g, data.recipientName ?? '')
+        .replace(/\{\{ttlHours\}\}/g, String(data.ttlHours))
+    : `Activate your ${data.portName} client portal account`;
   const greeting = data.recipientName ? `Dear ${escapeHtml(data.recipientName)},` : 'Welcome,';
 
   const body = `
@@ -97,8 +105,16 @@ export function activationEmail(data: ActivationData): {
   return { subject, html: shell({ title: subject, body }), text };
 }
 
-export function resetEmail(data: ResetData): { subject: string; html: string; text: string } {
-  const subject = `Reset your ${data.portName} client portal password`;
+export function resetEmail(
+  data: ResetData,
+  overrides?: { subject?: string | null },
+): { subject: string; html: string; text: string } {
+  const subject = overrides?.subject
+    ? overrides.subject
+        .replace(/\{\{portName\}\}/g, data.portName)
+        .replace(/\{\{recipientName\}\}/g, data.recipientName ?? '')
+        .replace(/\{\{ttlMinutes\}\}/g, String(data.ttlMinutes))
+    : `Reset your ${data.portName} client portal password`;
   const greeting = data.recipientName ? `Dear ${escapeHtml(data.recipientName)},` : 'Hello,';
 
   const body = `