chore: check in pending work — queue preferences, QBO AR diagnostics, mobile engagement fixes, ops scripts

Bundles several in-progress efforts that were sitting uncommitted:
- User queue-preferences (migration 087, API route, popover component)
- QBO invoice soft-delete (migration 088) and AR diagnostics route
- Dashboard/mobile engagement route and page adjustments
- Docker Compose log-rotation config
- One-off ticket/RMM investigation scripts (scripts/)
- Planning docs: phase verification/pattern notes, mobile shell design spec
- .gitignore: exclude local scratch financial/inventory data and Claude Code
  worktree/local-settings runtime state (never meant for version control)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W6RuWdiUiXrPK6FLBHjtpY

scripts/verify-held-date-scope.ts

@@ -0,0 +1,56 @@
+import { config } from 'dotenv';
+import { resolve } from 'path';
+config({ path: resolve('/opt/stacks/pulse/.env.local') });
+
+import postgresClient from '../lib/services/postgres-client';
+import { getMimecastClientForTenant } from '../lib/services/mimecast-client';
+
+const SEUBERT_COMPANY_ID = 29683407;
+const RECIPIENT = 'btomlinson@seubert.com';
+
+async function main() {
+  const tenantRow = await postgresClient.query<any>(
+    `SELECT client_id, client_secret, base_url, account_name FROM mimecast_tenants WHERE company_id = $1 AND enabled = true`,
+    [SEUBERT_COMPANY_ID]
+  );
+  const tenant = tenantRow.rows[0];
+  const client: any = getMimecastClientForTenant({
+    client_id: tenant.client_id,
+    client_secret: tenant.client_secret,
+    base_url: tenant.base_url ?? undefined,
+  });
+
+  // Exact production window: createdAt (report creation, 2026-07-17T18:10:55Z) +/- 24h, end clamped to now.
+  const createdAt = new Date('2026-07-17T18:10:55.844Z');
+  const start = new Date(createdAt.getTime() - 24 * 60 * 60 * 1000);
+  const end = new Date(Math.min(createdAt.getTime() + 24 * 60 * 60 * 1000, Date.now()));
+  const startStr = start.toISOString().replace(/\.\d{3}Z$/, '+0000');
+  const endStr = end.toISOString().replace(/\.\d{3}Z$/, '+0000');
+
+  console.log(`Querying held messages for ${RECIPIENT} scoped to the EXACT production window: ${startStr}..${endStr}`);
+
+  const body = {
+    data: [
+      {
+        admin: true,
+        start: startStr,
+        end: endStr,
+        searchBy: { fieldName: 'recipient', value: RECIPIENT },
+      },
+    ],
+  };
+
+  const result = await client.request('POST', '/api/gateway/get-hold-message-list', body);
+  const msgs = result?.data ?? [];
+  console.log(`Rows returned: ${msgs.length}`);
+  console.log(JSON.stringify(msgs.map((m: any) => ({
+    from: m.fromHeader?.emailAddress ?? m.from?.emailAddress,
+    subject: m.subject,
+    dateReceived: m.dateReceived,
+    reason: m.reason,
+  })), null, 2));
+
+  process.exit(0);
+}
+
+main().catch((err) => { console.error(err); process.exit(1); });