feat(phase-b): ship analytics dashboard, alerts, scanner PWA, dedup, audit view

Phase B (Insights & Alerts) PR4-11 in one drop. Builds on the schema +
service skeletons committed in PRs 1-3.

PR4  Analytics dashboard — 4 chart types (funnel/timeline/breakdown/source),
     date-range picker (today/7d/30d/90d), CSV+PNG export per card.
PR5  Alert rail UI + /alerts page — topbar bell w/ live count, dashboard
     right-rail, three-tab page (active/dismissed/resolved), socket-driven
     invalidation. Bell lazy-loads list on popover open to keep cold pages
     fast in non-dashboard routes.
PR6  EOI queue tab on documents hub — filters to in-flight EOIs, count
     surfaces in tab label.
PR7  Interests-by-berth tab on berth detail — replaces the stub.
PR8  Expense duplicate detection — BullMQ job runs scan on create, yellow
     banner on detail w/ Merge / Not-a-duplicate, transactional merge
     consolidates receipts and archives the source.
PR9  Receipt scanner PWA + multi-provider AI — port-scoped /scan route in
     its own (scanner) group with no dashboard chrome, dynamic per-port
     manifest, OpenAI + Claude provider abstraction, admin OCR settings
     page (port-level + super-admin global default w/ opt-in fallback),
     test-connection endpoint, manual-entry fallback when no key is
     configured. Verify form always shown before save — no ghost rows.
PR10 Audit log read view — swap to tsvector full-text search on the
     existing GIN index, cursor pagination, filters for entity/action/user
     /date range, batched actor-email resolution.
PR11 Real-API tests — opt-in receipt-ocr.spec (admin save+test, optional
     real-receipt parse via REALAPI_RECEIPT_FIXTURE) and alert-engine
     socket-fanout spec gated behind RUN_ALERT_ENGINE_REALAPI. Both skip
     cleanly without their gate envs so CI stays green.

Test totals: vitest 690 -> 713, smoke 130 -> 138, realapi +2 opt-in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/expenses.ts

@@ -11,7 +11,11 @@ import { NotFoundError, ConflictError } from '@/lib/errors';
 import { emitToRoom } from '@/lib/socket/server';
 import { convert } from '@/lib/services/currency';
 import { logger } from '@/lib/logger';
-import type { CreateExpenseInput, UpdateExpenseInput, ListExpensesInput } from '@/lib/validators/expenses';
+import type {
+  CreateExpenseInput,
+  UpdateExpenseInput,
+  ListExpensesInput,
+} from '@/lib/validators/expenses';
 
 export type { ListExpensesInput };
 
@@ -59,7 +63,10 @@ export async function listExpenses(portId: string, query: ListExpensesInput) {
     includeArchived: query.includeArchived,
     archivedAtColumn: expenses.archivedAt,
     sort: query.sort
-      ? { column: expenses[query.sort as keyof typeof expenses] as unknown as PgColumn, direction: query.order }
+      ? {
+          column: expenses[query.sort as keyof typeof expenses] as unknown as PgColumn,
+          direction: query.order,
+        }
       : undefined,
   });
 }
@@ -87,7 +94,10 @@ export async function createExpense(
       exchangeRate = String(conversion.rate);
     } else {
       // BR-040: if rate unavailable, save without conversion + log warning
-      logger.warn({ currency: data.currency }, 'Currency rate unavailable, saving expense without USD conversion');
+      logger.warn(
+        { currency: data.currency },
+        'Currency rate unavailable, saving expense without USD conversion',
+      );
     }
   } else {
     amountUsd = String(data.amount);
@@ -137,6 +147,15 @@ export async function createExpense(
     category: expense.category ?? '',
   });
 
+  // Schedule a duplicate-detection sweep. Best-effort — we don't want a
+  // queue-side hiccup to fail the user's create.
+  try {
+    const { getQueue } = await import('@/lib/queue');
+    await getQueue('maintenance').add('expense-dedup-scan', { expenseId: expense.id });
+  } catch (err) {
+    logger.warn({ err, expenseId: expense.id }, 'Failed to enqueue expense-dedup-scan');
+  }
+
   return expense;
 }
 
@@ -161,7 +180,10 @@ export async function updateExpense(
         updateData.amountUsd = String(conversion.result);
         updateData.exchangeRate = String(conversion.rate);
       } else {
-        logger.warn({ currency: newCurrency }, 'Currency rate unavailable during update, clearing USD conversion');
+        logger.warn(
+          { currency: newCurrency },
+          'Currency rate unavailable during update, clearing USD conversion',
+        );
         updateData.amountUsd = null;
         updateData.exchangeRate = null;
       }
@@ -204,11 +226,7 @@ export async function updateExpense(
   return updated;
 }
 
-export async function archiveExpense(
-  id: string,
-  portId: string,
-  meta: ServiceAuditMeta,
-) {
+export async function archiveExpense(id: string, portId: string, meta: ServiceAuditMeta) {
   const existing = await getExpenseById(id, portId);
 
   // BR-045: Check if linked to non-draft invoice
@@ -216,12 +234,7 @@ export async function archiveExpense(
     .select({ invoiceId: invoiceExpenses.invoiceId })
     .from(invoiceExpenses)
     .innerJoin(invoices, eq(invoices.id, invoiceExpenses.invoiceId))
-    .where(
-      and(
-        eq(invoiceExpenses.expenseId, id),
-        sql`${invoices.status} != 'draft'`,
-      ),
-    )
+    .where(and(eq(invoiceExpenses.expenseId, id), sql`${invoices.status} != 'draft'`))
     .limit(1);
 
   if (linkedInvoice.length > 0) {
@@ -244,11 +257,7 @@ export async function archiveExpense(
   emitToRoom(`port:${portId}`, 'expense:archived', { expenseId: id });
 }
 
-export async function restoreExpense(
-  id: string,
-  portId: string,
-  meta: ServiceAuditMeta,
-) {
+export async function restoreExpense(id: string, portId: string, meta: ServiceAuditMeta) {
   await getExpenseById(id, portId);
 
   await restore(expenses, expenses.id, id);