frontend: fix onboarding bounce, mobile sidebar btn, notif deep-links, analysis header

- Fix clinic onboarding loop: refresh session after setActive before navigating,
  surface setActive errors, and guard AppAuthGuard's onboarding redirect race (#1)
- Add a mobile-only floating top-right SidebarTrigger so the sidebar is reachable
  when the offcanvas sidebar is closed on phones (#5)
- Make notifications clickable: navigate to the source (conversation/patient) and
  mark read; MessagesView/PatientsView honor ?conversation= / ?file= deep links (#6)
- Analysis page: add an Overview header with a time-range segmented control and a
  Customize popover that shows/hides sections; range slices month-based charts (#10)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/components/auth/app-auth-guard.tsx

@@ -34,12 +34,23 @@ export function AppAuthGuard({ children }: { children: ReactNode }) {
 
     // Signed in but no active clinic selected yet.
     if (orgsPending) return;
+    // A setActive is already in flight (e.g. just after creating a clinic) — wait
+    // for it rather than treating the momentarily-empty list as "no clinics" and
+    // bouncing the user back to onboarding.
+    if (settingActive.current) return;
     const first = orgs?.[0];
     if (first) {
-      if (!settingActive.current) {
-        settingActive.current = true;
-        void authClient.organization.setActive({ organizationId: first.id });
-      }
+      settingActive.current = true;
+      void authClient.organization
+        .setActive({ organizationId: first.id })
+        // Refresh the cached session so activeOrganizationId is populated and the
+        // guard re-renders into the ready state.
+        .then(() =>
+          authClient.getSession({ query: { disableCookieCache: true } }),
+        )
+        .catch(() => {
+          settingActive.current = false;
+        });
     } else {
       router.replace("/onboarding");
     }