PR #4350 bumped scripts undici to ^7.28.0 AND added an `overrides.undici:
"$undici"` self-reference on main after this branch was cut. This branch had
the version bump but not the override, leaving scripts/package.json diverged
from main while the lockfile matched — which trips the pre-push lockfile-sync
gate. Add the missing override so scripts/package.json matches main exactly;
the lockfile is unchanged (already resolves undici 7.28.0).

Claude-Session: https://claude.ai/code/session_01KfKU1FUhPKvLQhU8tiUSfy

* fix(dashboard): gate live media on intent

* fix(live-media): harden lifecycle/race edges from PR review

Apply confirmed code-review findings on top of the intent-gating change:
- enforceExclusiveLiveMediaPlayback now deterministic (prefer live-news from
  both panels) so the surviving stream on always-on-off is not insertion-order
  dependent; cancel pending lazy-init when leaving always-on
- clear stuck .loading spinner on interrupted switchChannel early-returns
- restore deferredInit=true in triggerInit (re-entry guard)
- LiveWebcamsPanel.destroy() disconnects the IntersectionObserver first to
  avoid a teardown-time re-render/iframe leak
- drop the double stopLiveMediaForClose() on panel close (applyPanelSettings
  already fires it for disabled panels)
- guard stop callbacks: skip renderPlaceholder on a detached panel; skip
  webcam render() while document.hidden
- pauseForIdle arms idle-resume deterministically from isPlaying
- safe guards: clear eco idle timer in stopLiveMediaForClose; resumeFromIdle
  short-circuits when already owning media; isPanelVisible false on detached
  element; webcam settings-change won't start media while hidden
- add unit tests for the deterministic exclusive-survivor (preferred + fallback)

Claude-Session: https://claude.ai/code/session_01KfKU1FUhPKvLQhU8tiUSfy

* chore(scripts): align undici override with main (#4350)

PR #4350 bumped scripts undici to ^7.28.0 AND added an `overrides.undici:
"$undici"` self-reference on main after this branch was cut. This branch had
the version bump but not the override, leaving scripts/package.json diverged
from main while the lockfile matched — which trips the pre-push lockfile-sync
gate. Add the missing override so scripts/package.json matches main exactly;
the lockfile is unchanged (already resolves undici 7.28.0).

Claude-Session: https://claude.ai/code/session_01KfKU1FUhPKvLQhU8tiUSfy

…up tests

Code-review follow-ups for #4345:
- scripts/package.json: re-add overrides.undici "$undici" to match main
  (post-#4350). scripts/ is now byte-identical to main, clearing the husky
  pre-push lockfile-sync gate and re-pinning transitive undici. Lockfile is
  unchanged (already dedupes to 7.28.0).
- analytics.ts: fix the loadUmamiScript existing-script branch (flush only
  when window.umami is set, else attach the load listener; set
  umamiLoadStarted to close the re-entry gap); make initAnalytics synchronous
  (no await, sole caller voids it); add resetAnalyticsForTesting; move the
  #4183 data-domains note next to UMAMI_DOMAINS as the single source of truth.
- index.html: trim the Umami comment to a pointer at the new source of truth.
- tests: add coverage for scheduleAfterFirstPaint load-listener + rIC-absent
  fallback branches, Umami retry-exhaustion, 50-cap queue overflow,
  throw-then-queue-then-flush, and the existing-script branch.
- e2e: replace the flaky 250ms wait with the deterministic
  wmEventHandlersReady readiness gate.

Claude-Session: https://claude.ai/code/session_015dspobi7rUanvd9zSamz8a

* perf(dashboard): defer secondary startup payloads

* fix(security): bump scripts undici

* test(dashboard): assert deferred analytics startup

* fix(analytics): queue umami events on throw + restore happy Nunito italic

- sendUmamiCall: return false in the catch so a throwing window.umami
  defers to the bounded queue/flush path instead of silently dropping the
  event (callers only queue when sendUmamiCall returns false).
- buildDashboardFontStylesheetHref: restore the Nunito italic axis
  (ital,wght@0,400;0,600;0,700;1,400) the narrowed request dropped;
  happy-theme.css uses font-style:italic on Nunito-bodied elements, so the
  weight-only request regressed those to synthesized oblique. Weight
  narrowing (no 300) preserved.
- Update the two font-href assertions that had locked in the regression.

Addresses ce-code-review findings on PR #4345.

Claude-Session: https://claude.ai/code/session_0187W7sB8cdp8sYK7J7qDNLn

* fix(analytics): align scripts undici override + harden deferred-startup tests

Code-review follow-ups for #4345:
- scripts/package.json: re-add overrides.undici "$undici" to match main
  (post-#4350). scripts/ is now byte-identical to main, clearing the husky
  pre-push lockfile-sync gate and re-pinning transitive undici. Lockfile is
  unchanged (already dedupes to 7.28.0).
- analytics.ts: fix the loadUmamiScript existing-script branch (flush only
  when window.umami is set, else attach the load listener; set
  umamiLoadStarted to close the re-entry gap); make initAnalytics synchronous
  (no await, sole caller voids it); add resetAnalyticsForTesting; move the
  #4183 data-domains note next to UMAMI_DOMAINS as the single source of truth.
- index.html: trim the Umami comment to a pointer at the new source of truth.
- tests: add coverage for scheduleAfterFirstPaint load-listener + rIC-absent
  fallback branches, Umami retry-exhaustion, 50-cap queue overflow,
  throw-then-queue-then-flush, and the existing-script branch.
- e2e: replace the flaky 250ms wait with the deterministic
  wmEventHandlersReady readiness gate.

Claude-Session: https://claude.ai/code/session_015dspobi7rUanvd9zSamz8a