fire-planner: UX review pass 1 — fix sidebar/route/PATCH/badges issues

Round-1 fixes from the headless UI review:

Backend
- scenarios PATCH now allows config_json/name/description on cartesian
  scenarios (so users can pin flex_rules + notes that recompute will
  preserve). Core fields (jurisdiction/strategy/etc.) still blocked
  because they're rebuilt on recompute. Existing test updated.

Frontend
- Sidebar Plans switcher: drop the kind=user filter so the switcher
  surfaces all 120 cartesian scenarios that ship out of the box.
- Settings → Milestones now reachable at both /settings (index) and
  /settings/milestones (explicit) — the agent navigated to the latter
  and got a blank page.
- EventGantt background click capture: explicit pointerEvents="all" +
  fillOpacity=0 so click-to-add reliably fires on empty regions
  between bars.
- Plan tab stat badges moved out of the chart card into a dedicated
  row above the fan — previously they overlapped the chart's title,
  legend caption ("p10/p50/p..."), and right-side withdrawal axis.
- Stub tabs (Tax Analytics / Compare / Reports / Estate) and stub
  Settings sub-pages (Dividends / Bonds / Tax / Metrics / Other) get
  a "soon" badge + slate-300 styling so they're clearly placeholders.
- New "Portfolio depleted at this year" pill renders in the badge
  row when the scrubbed year's NW is 0 — previously the badges
  silently went to £0 with no UI cue.
- Test life-event from the smoke run cleaned up from prod DB.

246 pytest pass; mypy/ruff clean; frontend typecheck/test/build green.

fire_planner/api/scenarios.py

@@ -196,10 +196,22 @@ async def patch_scenario(
     scen = await session.get(Scenario, scenario_id)
     if scen is None:
         raise HTTPException(status_code=404, detail="Scenario not found")
-    if scen.kind != "user":
-        raise HTTPException(status_code=400,
-                            detail="Cannot patch cartesian scenarios — they're auto-generated")
     updates = payload.model_dump(exclude_unset=True)
+    if scen.kind != "user":
+        # Cartesian scenarios are rebuilt on every recompute — most core
+        # fields would be wiped by the next run, so we only allow updates
+        # to free-form metadata that we want to preserve across recomputes
+        # (notes, flex_rules, rate overrides). Hard-block edits to the
+        # parameters that define the scenario shape.
+        allowed_for_cartesian = {"config_json", "name", "description"}
+        bad = set(updates) - allowed_for_cartesian
+        if bad:
+            raise HTTPException(
+                status_code=400,
+                detail=("Cannot patch cartesian scenario fields {sorted(bad)} — "
+                        "they're auto-generated. Only config_json/name/description "
+                        "may be updated."),
+            )
     for k, v in updates.items():
         setattr(scen, k, v)
     await session.commit()