My Dashboard nav shortcut + analytics whitelist fix for engaged/ctb-offer

nav-dash.js on all header pages: a top-right My Dashboard button when the
visitor is known (msg session from wallet sign-in or the Mini App bridge is
authoritative; else the last dashboard opened on the device). Prospects with
no identity never see it.
recordEvent was silently dropping the new engaged + ctb-offer-* events
(whitelist); now recorded per source, with admin funnel tiles for both.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/nav-dash.js

@@ -0,0 +1,27 @@
+// "My Dashboard" shortcut in the top-right nav. Appears when we know who the
+// visitor is: an authenticated msg session (web wallet sign-in OR the Telegram
+// Mini App auth bridge) is authoritative; otherwise the last dashboard opened
+// on this device (ctb.myId, set by my.js) or the tools-page ID. No identity →
+// no button, so prospects never see it.
+(function () {
+  'use strict';
+  if (/^\/my(\/|$)/.test(location.pathname)) return;
+  var nav = document.querySelector('.nav-actions');
+  if (!nav) return;
+  function add(id) {
+    if (!id || !/^\d{1,15}$/.test(String(id))) return;
+    if (document.getElementById('navMyDash')) return;
+    var a = document.createElement('a');
+    a.id = 'navMyDash';
+    a.className = 'btn btn-secondary';
+    a.href = '/my/' + id;
+    a.textContent = '📊 My Dashboard';
+    nav.insertBefore(a, nav.firstChild);
+  }
+  var stored = null;
+  try { stored = localStorage.getItem('ctb.myId') || localStorage.getItem('rmc.toolsId'); } catch (e) {}
+  fetch('/api/public/msg-me')
+    .then(function (r) { return r.ok ? r.json() : null; })
+    .then(function (d) { add(d && d.id ? d.id : stored); })
+    .catch(function () { add(stored); });
+})();