feat(client-archive): single-client smart-archive dialog + CSP/middleware fixups

UI side of the smart-archive backend that shipped in d07f1ed.

- SmartArchiveDialog renders the dossier as a sectioned modal:
  Pipeline interests, Berths (with next-in-line listed), Yachts,
  Active reservations, Outstanding invoices, In-flight Documenso
  envelopes, Auto-handled summary. Each section has a per-row decision
  dropdown with sensible defaults (release for available/under-offer
  berths, retain for sold berths and yachts, cancel for active
  reservations, leave for invoices and documents).
- High-stakes deals show an amber warning panel + require a reason in
  the textarea before the Archive button enables. Signed-document
  acknowledgment checkbox blocks submission until checked.
- Wires into client-detail-header in place of the previous dumb
  ArchiveConfirmDialog (the simple confirm dialog is kept for the
  restore case until the smart-restore wizard ships).
- Pre-flight blocker banner surfaces dossier.blockers (e.g. active
  reservation on a sold berth) and disables the Archive button entirely.

Two side fixes from CSP rollout:
- next.config CSP allows unpkg.com in dev so the react-grab devtool
  loads. Stripped in prod via the existing isProd flag.
- middleware whitelist now passes /manifest.json + icon-*.png +
  apple-touch-icon through unauthenticated, so PWA installability
  isn't blocked by the auth redirect.

Bulk variant + restore wizard + hard-delete-with-email-code land in
follow-on commits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/clients/client-detail-header.tsx

@@ -9,6 +9,7 @@ import { Button } from '@/components/ui/button';
 import { Badge } from '@/components/ui/badge';
 import { TagBadge } from '@/components/shared/tag-badge';
 import { ArchiveConfirmDialog } from '@/components/shared/archive-confirm-dialog';
+import { SmartArchiveDialog } from '@/components/clients/smart-archive-dialog';
 import { DetailHeaderStrip } from '@/components/shared/detail-header-strip';
 import { PortalInviteButton } from '@/components/clients/portal-invite-button';
 import { GdprExportButton } from '@/components/clients/gdpr-export-button';
@@ -41,15 +42,6 @@ export function ClientDetailHeader({ client }: ClientDetailHeaderProps) {
 
   const isArchived = !!client.archivedAt;
 
-  const archiveMutation = useMutation({
-    mutationFn: () => apiFetch(`/api/v1/clients/${client.id}`, { method: 'DELETE' }),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['clients', client.id] });
-      queryClient.invalidateQueries({ queryKey: ['clients'] });
-      setArchiveOpen(false);
-    },
-  });
-
   const restoreMutation = useMutation({
     mutationFn: () => apiFetch(`/api/v1/clients/${client.id}/restore`, { method: 'POST' }),
     onSuccess: () => {
@@ -187,21 +179,27 @@ export function ClientDetailHeader({ client }: ClientDetailHeaderProps) {
         </div>
       </DetailHeaderStrip>
 
-      <ArchiveConfirmDialog
-        open={archiveOpen}
-        onOpenChange={setArchiveOpen}
-        entityName={client.fullName}
-        entityType="Client"
-        isArchived={isArchived}
-        onConfirm={() => {
-          if (isArchived) {
-            restoreMutation.mutate();
-          } else {
-            archiveMutation.mutate();
-          }
-        }}
-        isLoading={archiveMutation.isPending || restoreMutation.isPending}
-      />
+      {/* Restore flow keeps the simple confirm dialog (the smart restore
+          wizard ships in a follow-on commit). Archive uses the new smart
+          dialog with the dossier + per-section decisions. */}
+      {isArchived ? (
+        <ArchiveConfirmDialog
+          open={archiveOpen}
+          onOpenChange={setArchiveOpen}
+          entityName={client.fullName}
+          entityType="Client"
+          isArchived
+          onConfirm={() => restoreMutation.mutate()}
+          isLoading={restoreMutation.isPending}
+        />
+      ) : (
+        <SmartArchiveDialog
+          open={archiveOpen}
+          onOpenChange={setArchiveOpen}
+          clientId={client.id}
+          clientName={client.fullName}
+        />
+      )}
     </>
   );
 }