feat(telemetry): collections, universal server-fn coverage, beacon, client tracker

- activities indexes + client_events/client_errors/rollups/alerts collections
- global function middleware via createStart; reads skipped on success
- actor stash, denial dedup, control-flow error guards
- api route logging, auth event overrides, beacon endpoint, web vitals
- centralized admin role checks, shared skeletons, award-badges fix
- extracted deriveRunState with tests

src/utils/activities.test.ts

@@ -21,6 +21,8 @@ vi.mock("@/lib/logger", () => ({
 }));
 
 import { recordDeniedServerFn, serverFnLoggingMiddleware } from "./activities";
+import { setRequestActor } from "@/lib/telemetry/request-context.server";
+import { redirect } from "@tanstack/react-router";
 
 type ServerHandler = (opts: {
   next: () => Promise<unknown>;
@@ -192,6 +194,130 @@ describe("serverFnLoggingMiddleware", () => {
   });
 });
 
+const flushWrites = () => new Promise((resolve) => setTimeout(resolve, 20));
+
+describe("serverFnLoggingMiddleware read handling", () => {
+  it("skips successful read fns", async () => {
+    setRequest("http://localhost:3000/_serverFn/x");
+
+    await runMiddleware({
+      next: async () => successEnvelope,
+      data: undefined,
+      context: {},
+      serverFnMeta: { id: "x", name: "getPlayerStats" },
+    });
+
+    await flushWrites();
+    expect(h.createActivity).not.toHaveBeenCalled();
+  });
+
+  it("records failed read fns", async () => {
+    setRequest("http://localhost:3000/_serverFn/x");
+
+    await runMiddleware({
+      next: async () => ({
+        result: { success: false, error: { code: "NOT_FOUND" } },
+      }),
+      data: undefined,
+      context: {},
+      serverFnMeta: { id: "x", name: "getPlayerStats" },
+    });
+
+    await vi.waitFor(() => expect(h.createActivity).toHaveBeenCalledTimes(1));
+    expect(h.createActivity.mock.calls[0][0]).toMatchObject({
+      name: "getPlayerStats",
+      success: false,
+    });
+  });
+
+  it("records thrown errors from read fns", async () => {
+    setRequest("http://localhost:3000/_serverFn/x");
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw new Error("db down");
+        },
+        data: undefined,
+        context: {},
+        serverFnMeta: { id: "x", name: "listPlayers" },
+      })
+    ).rejects.toThrow("db down");
+
+    await vi.waitFor(() => expect(h.createActivity).toHaveBeenCalledTimes(1));
+  });
+});
+
+describe("serverFnLoggingMiddleware control flow and dedup", () => {
+  it("does not record a thrown Response (session refresh)", async () => {
+    setRequest("http://localhost:3000/_serverFn/doThing");
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw new Response("{}", { status: 401 });
+        },
+        data: undefined,
+        context: {},
+      })
+    ).rejects.toBeInstanceOf(Response);
+
+    await flushWrites();
+    expect(h.createActivity).not.toHaveBeenCalled();
+  });
+
+  it("does not record thrown redirects", async () => {
+    setRequest("http://localhost:3000/_serverFn/doThing");
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw redirect({ to: "/" });
+        },
+        data: undefined,
+        context: {},
+      })
+    ).rejects.toBeDefined();
+
+    await flushWrites();
+    expect(h.createActivity).not.toHaveBeenCalled();
+  });
+
+  it("does not double-record when a denial was already recorded for the request", async () => {
+    setRequest("http://localhost:3000/_serverFn/doThing");
+    recordDeniedServerFn(h.request as unknown as Request, { player_id: "p1" }, { name: "doThing" });
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw new Error("Unauthorized");
+        },
+        data: undefined,
+        context: {},
+        serverFnMeta: { id: "x", name: "doThing" },
+      })
+    ).rejects.toThrow("Unauthorized");
+
+    await flushWrites();
+    expect(h.createActivity).toHaveBeenCalledTimes(1);
+    expect(h.createActivity.mock.calls[0][0].error).toContain("FORBIDDEN");
+  });
+
+  it("prefers the stashed request actor over middleware context", async () => {
+    setRequest("http://localhost:3000/_serverFn/doThing");
+    setRequestActor(h.request as unknown as Request, { playerId: "p9" });
+
+    await runMiddleware({
+      next: async () => successEnvelope,
+      data: undefined,
+      context: { metadata: { player_id: "p1" } },
+    });
+
+    await vi.waitFor(() => expect(h.createActivity).toHaveBeenCalledTimes(1));
+    expect(h.createActivity.mock.calls[0][0].player).toBe("p9");
+  });
+});
+
 describe("recordDeniedServerFn", () => {
   const deniedRequest = (url: string) =>
     ({ url, headers: new Headers({ "user-agent": "vitest" }) }) as Request;