feat: sidebar CTA removal, delete phase/task, public dashboard UX, chat panel

1. AdminSidebar: removed yellow "Genera preventivo" CTA (duplicated Preventivi tab nav item)
2. Delete phase/task: new deletePhase/deleteTask server actions with FK cascade and phase-status recompute; DeletePhaseTaskButton client component with window.confirm; trash icons in PhasesTab per phase and per task
3. Public dashboard: extend activeOffers query with offer_macros join (offer_name, offer_type); reorder sidebar 1°Offerte 2°Pagamenti 3°Documenti; OffersSection shows macro public_name as heading (never tier letter/internal_name); PaymentStatus gains totalLabel/overrideAmount/hideRows props — retainer=monthly label + no Acconto/Saldo rows
4. Offer editor: Descrizione textarea (nota interna) and Modalità toggle moved directly under title; Tags section now contains only Categoria/Ticket/Tipo/Obiettivo
5. Basecamp chat: API route supports entity_type="phase" with authorization scoping; comments scope in client-view broadened to include phaseIds and client_id (general); CommentsTab updated with phase/general entities; ChatProvider React context; ChatPanel fixed slide-in panel with FAB (bottom-right) and composer tag selector (Generale + phases); PhaseCard gets chat-bubble icon pre-tagging that phase; inline ChatSection block removed from dashboard main column

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/api/client/comment/route.ts

@@ -7,7 +7,7 @@ import { rateLimit } from "@/lib/rate-limit";
 
 const commentSchema = z.object({
   token:       z.string().min(1),
-  entity_type: z.enum(["task", "deliverable", "general"]),
+  entity_type: z.enum(["task", "deliverable", "general", "phase"]),
   entity_id:   z.string().min(1),
   body:        z.string().min(1, "Il commento non può essere vuoto").max(2000),
 });
@@ -76,7 +76,12 @@ export async function POST(request: NextRequest) {
         .from(tasks)
         .where(inArray(tasks.phase_id, phaseIds));
 
-      if (entity_type === "task") {
+      if (entity_type === "phase") {
+        // Phase: entity_id must be one of the client's phases
+        if (!phasesForClient.find((p) => p.id === entity_id)) {
+          return NextResponse.json({ error: "Accesso non consentito" }, { status: 403 });
+        }
+      } else if (entity_type === "task") {
         if (!taskRows.find((r) => r.id === entity_id)) {
           return NextResponse.json({ error: "Accesso non consentito" }, { status: 403 });
         }