feat(telemetry): collections, universal server-fn coverage, beacon, client tracker

- activities indexes + client_events/client_errors/rollups/alerts collections
- global function middleware via createStart; reads skipped on success
- actor stash, denial dedup, control-flow error guards
- api route logging, auth event overrides, beacon endpoint, web vitals
- centralized admin role checks, shared skeletons, award-badges fix
- extracted deriveRunState with tests

src/utils/supertokens.ts

@@ -5,6 +5,7 @@ import {
 } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { Logger } from "@/lib/logger";
+import { isAdminRole } from "@/features/core/utils/roles";
 import z from "zod";
 
 const logger = new Logger("Middleware");
@@ -25,6 +26,28 @@ export const superTokensRequestMiddleware = createMiddleware({
   return next({ context });
 });
 
+// Session context when available, anonymous otherwise — never throws or
+// redirects. For endpoints that must accept logged-out traffic (telemetry
+// beacon: login-page errors are exactly the signal we want).
+export const superTokensOptionalRequestMiddleware = createMiddleware({
+  type: "request",
+}).server(async ({ next, request }) => {
+  type SessionContext = Awaited<ReturnType<typeof getSessionContext>>;
+  let context: SessionContext;
+  try {
+    context = await getSessionContext(request);
+  } catch {
+    context = {
+      userAuthId: null,
+      roles: [],
+      metadata: undefined,
+      phone: undefined,
+      player: null,
+    } as unknown as SessionContext;
+  }
+  return next({ context });
+});
+
 export const superTokensFunctionMiddleware = createMiddleware({
   type: "function",
 }).server(async ({ next }) => {
@@ -58,7 +81,7 @@ export const superTokensAdminFunctionMiddleware = createMiddleware({
   try {
     const context = await getSessionContext(request, { isServerFunction: true });
 
-    if (context.roles?.includes("Admin")) {
+    if (isAdminRole(context.roles)) {
       return next({ context });
     }