Production hardening pass

Site CI now fails on any new lint warning, the marketing error page surfaces a contact-support CTA, and dashboard CTAs are wired into analytics so we can see drop-off in onboarding, member invites, and org renames.

• CI lint budget locked to zero new warnings
• Vercel Cron daily cleanup of AI request logs
• Sentry release + dist tags so mobile crashes group per-build

Offline retry queue gets exponential backoff

Stock movements that fail to sync now back off exponentially (30s → 1m → 5m → 15m → 1h → 6h → 24h) instead of hammering the API on every reconnect. Permanently failed movements land in a dedicated diagnostic screen with retry / clear actions.

• Bounded retry budget per movement (8 attempts)
• Failed Movements screen linked from Settings
• Defensive schema-version assertion on cold boot

Insights tab redesign

Tighter KPI strip, clearer hierarchy between headline metrics and drill-down, and tasteful entrance animations that respect reduce-motion. Empty / loading / error states now look like first-class UI instead of placeholders.

Catalog row redesign

Two-line product rows with brand-tinted thumbnails and an explicit add affordance. Faster to scan, more obvious tap targets, and the same screen does double duty as both browse and pick-mode.

Tenant-scoping helpers

Internal: every screen that receives org / venue IDs from URL params now goes through `resolveActiveTenant` and `setActiveLocationSafe`, which reject deep links pointing at venues the user no longer has selected. No user-visible change — but cross-tenant deep links can no longer silently scope queries.