feat(design): nav/visual overhaul — brand layer, /status route, KPI dashboard, TanStack DataTable

Major UI refresh on the nav-design-improvements branch.  Drops 2013-era
inline styles and consolidates patterns behind shared primitives.

Foundation
- New Wulf brand layer in app/styles/brand.css repointing --primary to
  the standards-guide blue (#0075AD) with utility classes for numerics
  (.num / .num-lg / .num-xl), metric labels, surface tints, and the
  wolf-mark watermark
- Switch primary face to IBM Plex Sans + IBM Plex Mono via next/font;
  Helvetica/Arial stays in the fallback chain for brand fidelity
- Wordmark subtitle changed from "PSA Management System" to
  "Operations console" everywhere it appeared
- Tagline footer ("Don't be afraid to cry") on every non-mobile page

Status moved out of /dashboard
- New /status route with integration tiles grouped by category, sync
  health table, worker pulse cards (analyzer / RMM / sync scheduler),
  token-expiry section, conditional alert banner
- Top-bar StatusIndicator polls integration health every 60s and links
  to /status
- INTEGRATIONS_DISABLED env var suppresses operator-disabled
  integrations (e.g. SentinelOne) — no failure noise from broken-on-
  purpose entries.  Aliases supported (sentinelone → s1, etc.)

Dashboard rebuilt around KPIs
- /api/dashboard/overview adds today snapshot (opened, resolved, open
  total, SLA breaches) with delta math
- /api/dashboard/trends backs queue × priority heatmap, 30-day volume
  area chart, 30-day mean resolution time line chart, today's active
  engineers leaderboard

Components
- StatusBadge driven by lib/status-registry.ts (priority, ticket
  status, classification, source, company type, publish, active /
  yes-no / billable / approved registries)
- StatusLight (8px geometric square, five states, three sizes)
- EmptyState (shared dashed panel with icon + headline + optional CTA)
- KpiCard with delta indicator and tonal left border
- WulfMark (mark / wordmark variants from /public/branding)
- Skeleton helpers (SkeletonRow / Rows / Card / Chart / Header / Table)

Navigation
- Admin flat link → dropdown with seven shortcuts
- New UserMenu (initials avatar, role badge, settings + sign-out)
- Active-route highlight is now a 2px Wulf-blue underline echoing the
  PageHeader rule (consistent across flat links and submenu triggers);
  active children inside dropdowns use bg-primary/10
- Submenu width is content-driven (min-w 320 / max-w 440, single col)
- Mobile hamburger via Sheet, reuses the same nav config

Pages migrated
- 16 admin sub-pages adopt PageHeader (with accent prop)
- /addigy-devices: shadcn Table + Checkbox; PageHeader; status badges
- 10 raw <table> blocks across admin/sync/* migrated to shadcn Table
- /veeam-analysis migrated to shadcn Table (kept its expansion logic)
- Detail routes (analyzer ticket, analyzer analysis) get breadcrumbs

DataTable
- Rewritten on @tanstack/react-table v8 in manual mode; external API
  unchanged so all 10+ data-browser pages keep working
- New optional props for drill-down rows: getRowCanExpand + renderSubRow

Mobile
- Multi-select Popover gets max-w-[calc(100vw-1rem)] and
  collisionPadding so dropdowns can't overflow narrow viewports
- CI filter bar wraps and shrinks; stat pill flows below

Docs
- New ARCHITECTURE.md (load-bearing reference for runtime, data flow,
  workers, analyzer pipeline, auth, deployment, gotchas)
- New DESIGN.md (tokens, layout, navigation IA, component vocabulary,
  rolling backlog of remaining cleanup)
- CLAUDE.md refreshed with pointers to the two new docs and the
  INTEGRATIONS_DISABLED operator config note
- shadcn registry registered as project-level MCP server (.mcp.json)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/status/workers/route.ts

@@ -0,0 +1,102 @@
+/**
+ * GET /api/status/workers
+ *   Heartbeat snapshot for the three in-process workers:
+ *     • analyzer  — analyzer_jobs
+ *     • rmm       — rmm_executions
+ *     • sync      — sync_schedules / sync_history (proxy for the scheduler)
+ *
+ *   For each: last activity timestamp, in-flight count, last-1h success/
+ *   failure totals.  Cheap — just SELECT COUNT(*) FILTER queries. */
+
+import { NextResponse } from 'next/server';
+import { requireAuth } from '@/lib/auth-utils';
+import postgresClient from '@/lib/services/postgres-client';
+
+export interface WorkerSnapshot {
+  name: string;
+  lastActivity: string | null;
+  inFlight: number;
+  oneHour: { success: number; failure: number };
+}
+
+export async function GET() {
+  const { error } = await requireAuth();
+  if (error) return error;
+
+  const [analyzerRes, rmmRes, syncRes] = await Promise.all([
+    postgresClient.query<{
+      last_activity: string | null;
+      in_flight: string;
+      ok_1h: string;
+      fail_1h: string;
+    }>(
+      `SELECT
+         GREATEST(MAX(queued_at), MAX(started_at), MAX(finished_at))::text         AS last_activity,
+         COUNT(*) FILTER (WHERE status IN ('queued','fetching','triaging','itglue','analyzing','deep_review'))::text AS in_flight,
+         COUNT(*) FILTER (WHERE status = 'complete' AND finished_at >= NOW() - INTERVAL '1 hour')::text AS ok_1h,
+         COUNT(*) FILTER (WHERE status = 'failed'   AND finished_at >= NOW() - INTERVAL '1 hour')::text AS fail_1h
+       FROM analyzer_jobs`,
+    ),
+    postgresClient.query<{
+      last_activity: string | null;
+      in_flight: string;
+      ok_1h: string;
+      fail_1h: string;
+    }>(
+      `SELECT
+         GREATEST(MAX(queued_at), MAX(started_at), MAX(completed_at))::text       AS last_activity,
+         COUNT(*) FILTER (WHERE status IN ('queued','running'))::text             AS in_flight,
+         COUNT(*) FILTER (WHERE status = 'complete' AND completed_at >= NOW() - INTERVAL '1 hour')::text AS ok_1h,
+         COUNT(*) FILTER (WHERE status IN ('failed','timeout') AND completed_at >= NOW() - INTERVAL '1 hour')::text AS fail_1h
+       FROM rmm_executions`,
+    ),
+    postgresClient.query<{
+      last_run: string | null;
+      ok_1h: string;
+      fail_1h: string;
+    }>(
+      `SELECT
+         MAX(last_run)::text                                                       AS last_run,
+         COUNT(*) FILTER (WHERE last_status = 'success' AND last_run >= NOW() - INTERVAL '1 hour')::text AS ok_1h,
+         COUNT(*) FILTER (WHERE last_status = 'failed'  AND last_run >= NOW() - INTERVAL '1 hour')::text AS fail_1h
+       FROM sync_schedules
+       WHERE is_enabled = true`,
+    ),
+  ]);
+
+  const a = analyzerRes.rows[0];
+  const r = rmmRes.rows[0];
+  const s = syncRes.rows[0];
+
+  const workers: WorkerSnapshot[] = [
+    {
+      name: 'Analyzer',
+      lastActivity: a?.last_activity ?? null,
+      inFlight: parseInt(a?.in_flight ?? '0', 10),
+      oneHour: {
+        success: parseInt(a?.ok_1h ?? '0', 10),
+        failure: parseInt(a?.fail_1h ?? '0', 10),
+      },
+    },
+    {
+      name: 'RMM Overshell',
+      lastActivity: r?.last_activity ?? null,
+      inFlight: parseInt(r?.in_flight ?? '0', 10),
+      oneHour: {
+        success: parseInt(r?.ok_1h ?? '0', 10),
+        failure: parseInt(r?.fail_1h ?? '0', 10),
+      },
+    },
+    {
+      name: 'Sync scheduler',
+      lastActivity: s?.last_run ?? null,
+      inFlight: 0,
+      oneHour: {
+        success: parseInt(s?.ok_1h ?? '0', 10),
+        failure: parseInt(s?.fail_1h ?? '0', 10),
+      },
+    },
+  ];
+
+  return NextResponse.json({ workers });
+}