fix(04-06): five post-deploy fixes

- Middleware (proxy.ts): switch internal API calls to localhost instead of
  request.url — avoids Docker hairpin NAT issues where the container can't
  reach its own external hostname via Traefik
- ProjectRow timer: pass projectId={project.id} to TimerCell so it calls
  startTimer(projectId) directly instead of startTimerForClient(project.id)
- Admin client list: add slug field to ClientWithPayments + show slug link
  when available (falls back to token) — so admins see the human-readable URL
- Analytics contracted: sum projects.accepted_total (authoritative) instead
  of clients.accepted_total (always 0 in multi-project architecture)
- createClient: auto-generate slug from client name at creation time
  (e.g. "Mario Rossi" → "mario-rossi"), with -2/-3 suffix on conflict

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/proxy.ts

@@ -38,23 +38,21 @@ export async function proxy(request: NextRequest) {
     const slugOrToken = slugOrTokenMatch[1];
 
     try {
-      // Call internal Node.js API route — Edge middleware cannot use postgres-js directly
-      // postgres-js requires Node.js net/tls which are unavailable in the Edge runtime
+      // Use localhost to avoid hairpin NAT issues in Docker.
+      // request.url is the external hostname (via Traefik); inside the container the app is on localhost.
+      const port = process.env.PORT ?? "3000";
+      const base = `http://localhost:${port}`;
 
       // Try slug first (D-06) — user-friendly slugs before token fallback
-      const validateSlugUrl = new URL(
-        `/api/internal/validate-slug?slug=${encodeURIComponent(slugOrToken)}`,
-        request.url
+      let res = await fetch(
+        `${base}/api/internal/validate-slug?slug=${encodeURIComponent(slugOrToken)}`
       );
-      let res = await fetch(validateSlugUrl.toString());
 
       // If slug not found, fall back to token validation (existing links continue to work)
       if (!res.ok) {
-        const validateTokenUrl = new URL(
-          `/api/internal/validate-token?token=${encodeURIComponent(slugOrToken)}`,
-          request.url
+        res = await fetch(
+          `${base}/api/internal/validate-token?token=${encodeURIComponent(slugOrToken)}`
         );
-        res = await fetch(validateTokenUrl.toString());
       }
 
       if (!res.ok) {