Phase 4 checkpoint: chat-screen perf refactor + retryable blast-failure + repo-wide dispose-ref guardrail

Chat-screen performance (customer + mitra):
- Parent screens have zero `ref.watch` — only `ref.listen` for side effects
- Body extracted into its own `ConsumerStatefulWidget`; AppBar parts split
  into narrow `.select` consumers (mode, sensitivity, timer)
- Per-second timer ticks routed to dedicated providers
  (`chatRemainingSecondsProvider` + new `mitraChatRemainingSecondsProvider`)
  so WS `session_tick` frames don't invalidate the rest of the chat state

Dispose-in-ref bug fix:
- `home_screen.dart`, `payment_screen.dart`, `mitra_chat_screen.dart` —
  ref-using cleanup moved from `dispose()` to `deactivate()`. Modern
  Riverpod invalidates `ref` the moment `dispose()` runs; the resulting
  silent error corrupts the widget-tree finalize and the next screen
  appears frozen
- `halo_lints` package added at repo root with `no_ref_in_dispose` rule
  to catch this pattern in CI / IDE analysis
- `custom_lint` activated in both apps' `analysis_options.yaml`
  (was installed but never wired in — also brings `riverpod_lint`'s
  `avoid_ref_inside_state_dispose` online)
- CLAUDE.md Pitfalls section added to client_app + mitra_app

Phase 4 §3 retryable blast-failure (Option A):
- Backend `expirePairingRequest` + all-rejected use
  `recordIntermediateFailure` instead of `failPaymentSession` so the
  payment session stays `confirmed` for re-blast
- WS `pairing_failed` payload carries `is_terminal: false` on the
  retryable paths; client parses the flag and exposes `retryBlast()`
- "Coba cari lagi" CTA on S7 Timeout now re-blasts on the same payment
- Pairing service test updated to reflect the new semantics

Customer waiting-payment screen navigation patch:
- `_navigateTerminal` uses `Future.microtask` + `addPostFrameCallback`
  redundancy after a release-mode bug where polling stopped but
  `context.go` never fired, leaving the screen visually stuck on
  "menunggu pembayaran"

See requirement/resume-2026-05-15.md for next-day pickup checklist
(mitra release rebuild + S21 Ultra install + retest is the gating item).

Bundles unrelated in-flight Phase 4 §2.x work that was already on disk
(ESP screen removal, USP one-time gate scaffolding, bestie-availability
public route, OTP service edits, Maestro flow tweaks) — kept together
to avoid a partial-rebase mess.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

halo_lints/lib/halo_lints.dart

@@ -0,0 +1,76 @@
+import 'package:analyzer/dart/ast/ast.dart';
+import 'package:analyzer/dart/ast/visitor.dart';
+import 'package:analyzer/error/listener.dart';
+import 'package:custom_lint_builder/custom_lint_builder.dart';
+
+/// custom_lint entry point — discovered by the plugin loader.
+PluginBase createPlugin() => _HaloLintsPlugin();
+
+class _HaloLintsPlugin extends PluginBase {
+  @override
+  List<LintRule> getLintRules(CustomLintConfigs configs) => [
+        const NoRefInDisposeRule(),
+      ];
+}
+
+/// Flags any use of `ref` (read/watch/listen/invalidate/etc.) inside the
+/// `dispose()` method of a class extending `ConsumerState` /
+/// `ConsumerStatefulWidgetState`.
+///
+/// Why: Riverpod invalidates `ref` the instant `State.dispose()` enters. The
+/// resulting `Bad state: Cannot use "ref" after the widget was disposed.` is
+/// caught silently inside `BuildOwner.finalizeTree`, leaves the widget tree
+/// half-finalized, and the next-pushed screen appears frozen. Real instances
+/// caught in this repo (2026-05-14): `home_screen.dart`, `payment_screen.dart`.
+///
+/// Fix: move the ref-using cleanup into `deactivate()`, which runs BEFORE
+/// `dispose()` while `ref` is still valid. See client_app/CLAUDE.md → Pitfalls.
+class NoRefInDisposeRule extends DartLintRule {
+  const NoRefInDisposeRule() : super(code: _code);
+
+  static const _code = LintCode(
+    name: 'no_ref_in_dispose',
+    problemMessage:
+        "Don't use 'ref' in dispose(). Riverpod invalidates ref the moment "
+        "dispose() runs; the resulting error is swallowed and silently "
+        "corrupts the widget tree (next screen freezes). Move this cleanup "
+        "to deactivate() instead. See client_app/CLAUDE.md → Pitfalls.",
+  );
+
+  @override
+  void run(
+    CustomLintResolver resolver,
+    ErrorReporter reporter,
+    CustomLintContext context,
+  ) {
+    context.registry.addMethodDeclaration((method) {
+      if (method.name.lexeme != 'dispose') return;
+      final cls = method.parent;
+      if (cls is! ClassDeclaration) return;
+
+      // Walk up the supertype chain by name — element resolution is more
+      // robust but text-match is enough for the two real superclasses we
+      // care about, and avoids a full type resolve on every method.
+      final superName = cls.extendsClause?.superclass.name2.lexeme;
+      if (superName == null) return;
+      if (!superName.startsWith('Consumer')) return;
+
+      method.body.accept(_RefUsageVisitor(reporter));
+    });
+  }
+}
+
+class _RefUsageVisitor extends GeneralizingAstVisitor<void> {
+  final ErrorReporter reporter;
+  _RefUsageVisitor(this.reporter);
+
+  @override
+  void visitSimpleIdentifier(SimpleIdentifier node) {
+    // Match the bare identifier `ref` whenever it's USED (not declared).
+    // Declarations like `final ref = ...` are skipped via inDeclarationContext.
+    if (node.name == 'ref' && !node.inDeclarationContext()) {
+      reporter.atNode(node, NoRefInDisposeRule._code);
+    }
+    super.visitSimpleIdentifier(node);
+  }
+}