Phase 4 checkpoint: chat-screen perf refactor + retryable blast-failure + repo-wide dispose-ref guardrail

Chat-screen performance (customer + mitra):
- Parent screens have zero `ref.watch` — only `ref.listen` for side effects
- Body extracted into its own `ConsumerStatefulWidget`; AppBar parts split
  into narrow `.select` consumers (mode, sensitivity, timer)
- Per-second timer ticks routed to dedicated providers
  (`chatRemainingSecondsProvider` + new `mitraChatRemainingSecondsProvider`)
  so WS `session_tick` frames don't invalidate the rest of the chat state

Dispose-in-ref bug fix:
- `home_screen.dart`, `payment_screen.dart`, `mitra_chat_screen.dart` —
  ref-using cleanup moved from `dispose()` to `deactivate()`. Modern
  Riverpod invalidates `ref` the moment `dispose()` runs; the resulting
  silent error corrupts the widget-tree finalize and the next screen
  appears frozen
- `halo_lints` package added at repo root with `no_ref_in_dispose` rule
  to catch this pattern in CI / IDE analysis
- `custom_lint` activated in both apps' `analysis_options.yaml`
  (was installed but never wired in — also brings `riverpod_lint`'s
  `avoid_ref_inside_state_dispose` online)
- CLAUDE.md Pitfalls section added to client_app + mitra_app

Phase 4 §3 retryable blast-failure (Option A):
- Backend `expirePairingRequest` + all-rejected use
  `recordIntermediateFailure` instead of `failPaymentSession` so the
  payment session stays `confirmed` for re-blast
- WS `pairing_failed` payload carries `is_terminal: false` on the
  retryable paths; client parses the flag and exposes `retryBlast()`
- "Coba cari lagi" CTA on S7 Timeout now re-blasts on the same payment
- Pairing service test updated to reflect the new semantics

Customer waiting-payment screen navigation patch:
- `_navigateTerminal` uses `Future.microtask` + `addPostFrameCallback`
  redundancy after a release-mode bug where polling stopped but
  `context.go` never fired, leaving the screen visually stuck on
  "menunggu pembayaran"

See requirement/resume-2026-05-15.md for next-day pickup checklist
(mitra release rebuild + S21 Ultra install + retest is the gating item).

Bundles unrelated in-flight Phase 4 §2.x work that was already on disk
(ESP screen removal, USP one-time gate scaffolding, bestie-availability
public route, OTP service edits, Maestro flow tweaks) — kept together
to avoid a partial-rebase mess.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/lib/core/availability/mitra_availability_notifier.dart

@@ -6,16 +6,16 @@ part 'mitra_availability_notifier.g.dart';
 
 /// Customer-home availability poll.
 ///
-/// Polls `GET /api/client/mitra-availability` every 5 seconds while the home
-/// screen is in the foreground. Polling is gated by the home screen calling
-/// [setActive] from `WidgetsBindingObserver.didChangeAppLifecycleState`:
+/// Polls `GET /api/public/bestie/available` every 5 seconds while the home
+/// screen is in the foreground. The endpoint is unauthenticated by design —
+/// SHome1st renders before any JWT exists, and the CTA's enabled state needs
+/// to reflect global availability so users see whether bestie is online
+/// before committing to onboarding. Polling is gated by the home screen
+/// calling [setActive] from `WidgetsBindingObserver.didChangeAppLifecycleState`:
 ///   - resumed   → setActive(true)
 ///   - paused/inactive → setActive(false)
 ///
 /// On any HTTP error we emit `false` (never display stale state).
-///
-/// The endpoint also returns a `count`, but the customer UI must only read the
-/// binary `available` field — the count is for CC/debug only.
 @Riverpod(keepAlive: true)
 class MitraAvailability extends _$MitraAvailability {
   Timer? _pollTimer;
@@ -63,7 +63,10 @@ class MitraAvailability extends _$MitraAvailability {
     bool available;
     try {
       final api = ref.read(apiClientProvider);
-      final response = await api.get('/api/client/mitra-availability');
+      final response = await api.get(
+        '/api/public/bestie/available',
+        skipAuth: true,
+      );
       final data = response['data'] as Map<String, dynamic>?;
       available = data?['available'] as bool? ?? false;
     } catch (_) {

client_app/lib/core/availability/mitra_availability_notifier.g.dart

@@ -6,21 +6,21 @@ part of 'mitra_availability_notifier.dart';
 // RiverpodGenerator
 // **************************************************************************
 
-String _$mitraAvailabilityHash() => r'036de8fea66c6a0114abd4a422af12186c1447d7';
+String _$mitraAvailabilityHash() => r'e385c671720973cd1cea4b15933cd59421f035f0';
 
 /// Customer-home availability poll.
 ///
-/// Polls `GET /api/client/mitra-availability` every 5 seconds while the home
-/// screen is in the foreground. Polling is gated by the home screen calling
-/// [setActive] from `WidgetsBindingObserver.didChangeAppLifecycleState`:
+/// Polls `GET /api/public/bestie/available` every 5 seconds while the home
+/// screen is in the foreground. The endpoint is unauthenticated by design —
+/// SHome1st renders before any JWT exists, and the CTA's enabled state needs
+/// to reflect global availability so users see whether bestie is online
+/// before committing to onboarding. Polling is gated by the home screen
+/// calling [setActive] from `WidgetsBindingObserver.didChangeAppLifecycleState`:
 ///   - resumed   → setActive(true)
 ///   - paused/inactive → setActive(false)
 ///
 /// On any HTTP error we emit `false` (never display stale state).
 ///
-/// The endpoint also returns a `count`, but the customer UI must only read the
-/// binary `available` field — the count is for CC/debug only.
-///
 /// Copied from [MitraAvailability].
 @ProviderFor(MitraAvailability)
 final mitraAvailabilityProvider =