feat(insights): Phase B schema + service skeletons

PR1 of Phase B per docs/superpowers/specs/2026-04-28-phase-b-insights-alerts-design.md.
Lays the foundation that PRs 2-10 will fill in with behaviour.

Schema (migration 0014):
- alerts table with rule-engine fields (rule_id, severity, link,
  entity_type/id, fingerprint, fired/dismissed/acknowledged/resolved
  timestamps, jsonb metadata). Partial-unique fingerprint index keeps
  one open row per (port, rule, entity); separate indexes power
  severity-filtered and time-ordered queries.
- analytics_snapshots (port_id, metric_id) -> jsonb cache + computedAt
  for the 15-min recurring refresh.
- expenses: duplicate_of self-FK, dedup_scanned_at, ocr_status/raw/
  confidence; partial index on (port, vendor, amount, date) where
  duplicate_of IS NULL drives the dedup heuristic.
- audit_logs.search_text: GENERATED ALWAYS tsvector over
  action+entity_type+entity_id+user_id, GIN-indexed (drizzle can't
  model GENERATED ALWAYS in TS yet, so the migration appends manual
  ALTER + the GIN index).

Service skeletons in src/lib/services/:
- alerts.service.ts: fingerprintFor, reconcileAlertsForPort (upsert +
  auto-resolve), dismiss, acknowledge, listAlertsForPort.
- alert-rules.ts: RULE_REGISTRY of 10 rule evaluators (currently no-op);
  PR2 fills in the bodies.
- analytics.service.ts: readSnapshot/writeSnapshot with 15-min TTL +
  no-op compute* stubs for the four chart series; PR3 fills behavior.
- expense-dedup.service.ts: scanForDuplicates + markBestDuplicate
  using the partial dedup index. PR8 wires the BullMQ trigger.
- expense-ocr.service.ts: OcrResult/OcrLineItem types + ocrReceipt
  stub. PR9 wires Claude Vision (Haiku 4.5 + ephemeral system-prompt
  cache).
- audit-search.service.ts: tsvector @@ plainto_tsquery + cursor
  pagination on (createdAt, id). PR10 wires the admin UI.

tsc clean, lint clean, vitest 675/675 (one unrelated AES random-output
flake passes solo).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/alert-rules.ts

@@ -0,0 +1,31 @@
+/**
+ * Alert rule catalog. Each entry is a pure async function that takes a
+ * `portId` and returns an array of `AlertCandidate` rows the engine should
+ * upsert into `alerts`. Skeleton: signatures only — implementations land
+ * in PR2.
+ */
+
+import type { AlertCandidate } from './alerts.service';
+import { ALERT_RULES, type AlertRuleId } from '@/lib/db/schema/insights';
+
+type RuleEvaluator = (portId: string) => Promise<AlertCandidate[]>;
+
+/** Empty implementations — every evaluator returns no candidates. PR2
+ *  fills these in; the cron dispatcher in PR2 walks `RULE_REGISTRY`. */
+export const RULE_REGISTRY: Record<AlertRuleId, RuleEvaluator> = {
+  'reservation.no_agreement': async () => [],
+  'interest.stale': async () => [],
+  'document.expiring_soon': async () => [],
+  'document.signer_overdue': async () => [],
+  'berth.under_offer_stalled': async () => [],
+  'expense.duplicate': async () => [],
+  'expense.unscanned': async () => [],
+  'interest.high_value_silent': async () => [],
+  'eoi.unsigned_long': async () => [],
+  'audit.suspicious_login': async () => [],
+};
+
+/** Sanity check: catalog matches the ALERT_RULES literal type. */
+export function listRuleIds(): readonly AlertRuleId[] {
+  return ALERT_RULES;
+}