feat(telemetry): collections, universal server-fn coverage, beacon, client tracker

- activities indexes + client_events/client_errors/rollups/alerts collections
- global function middleware via createStart; reads skipped on success
- actor stash, denial dedup, control-flow error guards
- api route logging, auth event overrides, beacon endpoint, web vitals
- centralized admin role checks, shared skeletons, award-badges fix
- extracted deriveRunState with tests

src/app/routeTree.gen.ts

@@ -22,6 +22,7 @@ import { Route as AuthedAdminRouteImport } from './routes/_authed/admin'
 import { Route as AuthedTournamentsIndexRouteImport } from './routes/_authed/tournaments/index'
 import { Route as AuthedAdminIndexRouteImport } from './routes/_authed/admin/index'
 import { Route as ApiTournamentsUploadLogoRouteImport } from './routes/api/tournaments/upload-logo'
+import { Route as ApiTelemetryBeaconRouteImport } from './routes/api/telemetry/beacon'
 import { Route as ApiTeamsUploadLogoRouteImport } from './routes/api/teams/upload-logo'
 import { Route as ApiSpotifyTokenRouteImport } from './routes/api/spotify/token'
 import { Route as ApiSpotifySearchRouteImport } from './routes/api/spotify/search'
@@ -117,6 +118,11 @@ const ApiTournamentsUploadLogoRoute =
     path: '/api/tournaments/upload-logo',
     getParentRoute: () => rootRouteImport,
   } as any)
+const ApiTelemetryBeaconRoute = ApiTelemetryBeaconRouteImport.update({
+  id: '/api/telemetry/beacon',
+  path: '/api/telemetry/beacon',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const ApiTeamsUploadLogoRoute = ApiTeamsUploadLogoRouteImport.update({
   id: '/api/teams/upload-logo',
   path: '/api/teams/upload-logo',
@@ -303,6 +309,7 @@ export interface FileRoutesByFullPath {
   '/api/spotify/search': typeof ApiSpotifySearchRoute
   '/api/spotify/token': typeof ApiSpotifyTokenRoute
   '/api/teams/upload-logo': typeof ApiTeamsUploadLogoRoute
+  '/api/telemetry/beacon': typeof ApiTelemetryBeaconRoute
   '/api/tournaments/upload-logo': typeof ApiTournamentsUploadLogoRoute
   '/admin/': typeof AuthedAdminIndexRoute
   '/tournaments/': typeof AuthedTournamentsIndexRoute
@@ -345,6 +352,7 @@ export interface FileRoutesByTo {
   '/api/spotify/search': typeof ApiSpotifySearchRoute
   '/api/spotify/token': typeof ApiSpotifyTokenRoute
   '/api/teams/upload-logo': typeof ApiTeamsUploadLogoRoute
+  '/api/telemetry/beacon': typeof ApiTelemetryBeaconRoute
   '/api/tournaments/upload-logo': typeof ApiTournamentsUploadLogoRoute
   '/admin': typeof AuthedAdminIndexRoute
   '/tournaments': typeof AuthedTournamentsIndexRoute
@@ -390,6 +398,7 @@ export interface FileRoutesById {
   '/api/spotify/search': typeof ApiSpotifySearchRoute
   '/api/spotify/token': typeof ApiSpotifyTokenRoute
   '/api/teams/upload-logo': typeof ApiTeamsUploadLogoRoute
+  '/api/telemetry/beacon': typeof ApiTelemetryBeaconRoute
   '/api/tournaments/upload-logo': typeof ApiTournamentsUploadLogoRoute
   '/_authed/admin/': typeof AuthedAdminIndexRoute
   '/_authed/tournaments/': typeof AuthedTournamentsIndexRoute
@@ -435,6 +444,7 @@ export interface FileRouteTypes {
     | '/api/spotify/search'
     | '/api/spotify/token'
     | '/api/teams/upload-logo'
+    | '/api/telemetry/beacon'
     | '/api/tournaments/upload-logo'
     | '/admin/'
     | '/tournaments/'
@@ -477,6 +487,7 @@ export interface FileRouteTypes {
     | '/api/spotify/search'
     | '/api/spotify/token'
     | '/api/teams/upload-logo'
+    | '/api/telemetry/beacon'
     | '/api/tournaments/upload-logo'
     | '/admin'
     | '/tournaments'
@@ -521,6 +532,7 @@ export interface FileRouteTypes {
     | '/api/spotify/search'
     | '/api/spotify/token'
     | '/api/teams/upload-logo'
+    | '/api/telemetry/beacon'
     | '/api/tournaments/upload-logo'
     | '/_authed/admin/'
     | '/_authed/tournaments/'
@@ -555,6 +567,7 @@ export interface RootRouteChildren {
   ApiSpotifySearchRoute: typeof ApiSpotifySearchRoute
   ApiSpotifyTokenRoute: typeof ApiSpotifyTokenRoute
   ApiTeamsUploadLogoRoute: typeof ApiTeamsUploadLogoRoute
+  ApiTelemetryBeaconRoute: typeof ApiTelemetryBeaconRoute
   ApiTournamentsUploadLogoRoute: typeof ApiTournamentsUploadLogoRoute
   ApiFilesCollectionRecordIdFileRoute: typeof ApiFilesCollectionRecordIdFileRoute
 }
@@ -652,6 +665,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof ApiTournamentsUploadLogoRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/api/telemetry/beacon': {
+      id: '/api/telemetry/beacon'
+      path: '/api/telemetry/beacon'
+      fullPath: '/api/telemetry/beacon'
+      preLoaderRoute: typeof ApiTelemetryBeaconRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/api/teams/upload-logo': {
       id: '/api/teams/upload-logo'
       path: '/api/teams/upload-logo'
@@ -944,6 +964,7 @@ const rootRouteChildren: RootRouteChildren = {
   ApiSpotifySearchRoute: ApiSpotifySearchRoute,
   ApiSpotifyTokenRoute: ApiSpotifyTokenRoute,
   ApiTeamsUploadLogoRoute: ApiTeamsUploadLogoRoute,
+  ApiTelemetryBeaconRoute: ApiTelemetryBeaconRoute,
   ApiTournamentsUploadLogoRoute: ApiTournamentsUploadLogoRoute,
   ApiFilesCollectionRecordIdFileRoute: ApiFilesCollectionRecordIdFileRoute,
 }
@@ -952,10 +973,11 @@ export const routeTree = rootRouteImport
   ._addFileTypes<FileRouteTypes>()
 
 import type { getRouter } from './router.tsx'
-import type { createStart } from '@tanstack/react-start'
+import type { startInstance } from './start.ts'
 declare module '@tanstack/react-start' {
   interface Register {
     ssr: true
     router: Awaited<ReturnType<typeof getRouter>>
+    config: Awaited<ReturnType<typeof startInstance.getOptions>>
   }
 }