feat(phase-b): ship analytics dashboard, alerts, scanner PWA, dedup, audit view

Phase B (Insights & Alerts) PR4-11 in one drop. Builds on the schema +
service skeletons committed in PRs 1-3.

PR4  Analytics dashboard — 4 chart types (funnel/timeline/breakdown/source),
     date-range picker (today/7d/30d/90d), CSV+PNG export per card.
PR5  Alert rail UI + /alerts page — topbar bell w/ live count, dashboard
     right-rail, three-tab page (active/dismissed/resolved), socket-driven
     invalidation. Bell lazy-loads list on popover open to keep cold pages
     fast in non-dashboard routes.
PR6  EOI queue tab on documents hub — filters to in-flight EOIs, count
     surfaces in tab label.
PR7  Interests-by-berth tab on berth detail — replaces the stub.
PR8  Expense duplicate detection — BullMQ job runs scan on create, yellow
     banner on detail w/ Merge / Not-a-duplicate, transactional merge
     consolidates receipts and archives the source.
PR9  Receipt scanner PWA + multi-provider AI — port-scoped /scan route in
     its own (scanner) group with no dashboard chrome, dynamic per-port
     manifest, OpenAI + Claude provider abstraction, admin OCR settings
     page (port-level + super-admin global default w/ opt-in fallback),
     test-connection endpoint, manual-entry fallback when no key is
     configured. Verify form always shown before save — no ghost rows.
PR10 Audit log read view — swap to tsvector full-text search on the
     existing GIN index, cursor pagination, filters for entity/action/user
     /date range, batched actor-email resolution.
PR11 Real-API tests — opt-in receipt-ocr.spec (admin save+test, optional
     real-receipt parse via REALAPI_RECEIPT_FIXTURE) and alert-engine
     socket-fanout spec gated behind RUN_ALERT_ENGINE_REALAPI. Both skip
     cleanly without their gate envs so CI stays green.

Test totals: vitest 690 -> 713, smoke 130 -> 138, realapi +2 opt-in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/e2e/smoke/29-receipt-scanner.spec.ts

@@ -0,0 +1,50 @@
+import { test, expect } from '@playwright/test';
+import { login, PORT_SLUG } from './helpers';
+
+test.describe('Receipt scanner PWA (Phase B)', () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page, 'super_admin');
+  });
+
+  test('scanner page loads with capture button and no dashboard chrome', async ({ page }) => {
+    // First-hit dev compile of the brand-new (scanner) route group can exceed 30s.
+    await page.goto(`/${PORT_SLUG}/scan`, { timeout: 60_000 });
+    await expect(page.getByRole('heading', { name: /scan a receipt/i })).toBeVisible({
+      timeout: 20_000,
+    });
+    await expect(page.getByTestId('scan-capture')).toBeVisible({ timeout: 10_000 });
+
+    // No sidebar / topbar elements should be present on the scanner.
+    const dashboardLinks = page.getByRole('link', { name: 'Dashboard' });
+    expect(await dashboardLinks.count()).toBe(0);
+  });
+
+  test('per-port manifest is served with correct content type and scope', async ({ page }) => {
+    const res = await page.request.get(`/${PORT_SLUG}/scan/manifest.webmanifest`, {
+      timeout: 60_000,
+    });
+    expect(res.status()).toBe(200);
+    expect(res.headers()['content-type']).toContain('application/manifest+json');
+    const body = (await res.json()) as {
+      name: string;
+      scope: string;
+      start_url: string;
+      display: string;
+    };
+    expect(body.scope).toBe(`/${PORT_SLUG}/scan`);
+    expect(body.start_url).toBe(`/${PORT_SLUG}/scan`);
+    expect(body.display).toBe('standalone');
+    expect(body.name.toLowerCase()).toContain('scanner');
+  });
+
+  test('admin OCR settings page renders both provider and model selectors', async ({ page }) => {
+    await page.goto(`/${PORT_SLUG}/admin/ocr`, { timeout: 60_000 });
+    await expect(page.getByRole('heading', { name: /receipt ocr/i })).toBeVisible({
+      timeout: 30_000,
+    });
+    await expect(page.getByTestId('save-port')).toBeVisible({ timeout: 15_000 });
+    // Provider + model selects use Radix triggers, not native <label>; locate via testid.
+    await expect(page.locator('#provider-port')).toBeVisible();
+    await expect(page.locator('#model-port')).toBeVisible();
+  });
+});