feat(client-archive): single-client smart-archive dialog + CSP/middleware fixups

UI side of the smart-archive backend that shipped in d07f1ed.

- SmartArchiveDialog renders the dossier as a sectioned modal:
  Pipeline interests, Berths (with next-in-line listed), Yachts,
  Active reservations, Outstanding invoices, In-flight Documenso
  envelopes, Auto-handled summary. Each section has a per-row decision
  dropdown with sensible defaults (release for available/under-offer
  berths, retain for sold berths and yachts, cancel for active
  reservations, leave for invoices and documents).
- High-stakes deals show an amber warning panel + require a reason in
  the textarea before the Archive button enables. Signed-document
  acknowledgment checkbox blocks submission until checked.
- Wires into client-detail-header in place of the previous dumb
  ArchiveConfirmDialog (the simple confirm dialog is kept for the
  restore case until the smart-restore wizard ships).
- Pre-flight blocker banner surfaces dossier.blockers (e.g. active
  reservation on a sold berth) and disables the Archive button entirely.

Two side fixes from CSP rollout:
- next.config CSP allows unpkg.com in dev so the react-grab devtool
  loads. Stripped in prod via the existing isProd flag.
- middleware whitelist now passes /manifest.json + icon-*.png +
  apple-touch-icon through unauthenticated, so PWA installability
  isn't blocked by the auth redirect.

Bulk variant + restore wizard + hard-delete-with-email-code land in
follow-on commits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/middleware.ts

@@ -110,11 +110,14 @@ export const config = {
   matcher: [
     /*
      * Match all request paths except:
-     * - _next/static  (static files)
-     * - _next/image   (Next.js image optimisation)
-     * - favicon.ico
-     * - /images/      (public image assets)
+     * - _next/static     (static files)
+     * - _next/image      (Next.js image optimisation)
+     * - favicon.ico      (browser tab icon)
+     * - /images/         (public image assets)
+     * - manifest.json    (PWA manifest — must be unauthed for installability)
+     * - icon-*.png       (PWA + apple-touch icons referenced by manifest)
+     * - apple-touch-icon (iOS home-screen icon)
      */
-    '/((?!_next/static|_next/image|favicon\\.ico|images/).*)',
+    '/((?!_next/static|_next/image|favicon\\.ico|images/|manifest\\.json|icon-|apple-touch-icon).*)',
   ],
 };