feat: dynamic multi-select source-tool filter

[ClaudiaFang]

What

Converts the dashboard's "source tool" filter from a hardcoded, single-select dropdown (11 static entries in SourceToolSelect.tsx) to a multi-select control whose options are dynamically derived from what's actually in the SQLite database.

Why

Tools with zero sessions no longer clutter the picker, new source tools appear automatically without a code change, and users can filter by more than one tool at once (e.g. "Claude Code + Cursor").

How

• Server: added buildInCondition() (TDD, server/src/utils.ts / utils.test.ts) and swapped the four source_tool = ? exact-equality filters (shared-aggregation.ts, sessions.ts, analytics.ts, facets.ts) for source_tool IN (...), built from a comma-split of the incoming query param. A single value still produces an equivalent IN (?) clause, so existing single-value behavior is unchanged. Wire format stays a single CSV string (Zod schemas unchanged) — no new endpoints, consistent with how project/homeId/type filters already work.
• Dashboard: added useAvailableSourceTools() (dashboard/src/hooks/useFacets.ts), a thin React Query wrapper over the existing fetchFacetAggregation({period:'all'}) -> sourceTools: string[], 5-minute staleTime. Added SourceToolMultiSelect.tsx modeled directly on ProjectMultiSelect.tsx (Popover + Checkbox, value: string[] / onValueChange), self-fetching its option list, using SOURCE_TOOL_DISPLAY_NAMES for labels (falls back to title-case) and a DOT_COLORS map (moved from the old component, falls back to neutral gray for unknown ids).
• Converted all 5 call sites — InsightsPage, JournalPage, AnalyticsPage, SessionListPanel, ProjectNav (+ SessionsPage as the unchanged parent) — to the repo's existing comma-joined-string filter-state convention (same pattern already used for filters.project), converting to/from string[] only at the component boundary.
• Deleted SourceToolSelect.tsx and its hardcoded SOURCE_TOOLS array — confirmed via grep no remaining imports.

Schema Impact

• SQLite schema changed: no
• Types changed: no (query param semantics changed: source/sourceTool now accept CSV; Zod schemas remain z.string().optional())
• Server API changed: source/sourceTool filters on /api/sessions, /api/analytics/cache-by-source, /api/facets, /api/facets/aggregated, /api/facets/missing, /api/facets/missing-pq, /api/facets/outdated-pq now accept comma-separated values
• Backward compatible: yes — single-value CSV behaves identically to today's exact-match

Testing

• Added TDD tests for buildInCondition() in server/src/utils.test.ts (7 cases, written first and verified failing before implementation)
• Added CSV-filter test cases alongside each route's existing single-value test (sessions.test.ts, analytics.test.ts, shared-aggregation.test.ts) — existing single-value tests kept and updated only where the where-clause string shape changed (= ? -> IN (?))
• cd server && pnpm build && pnpm test — 677/677 passing
• cd dashboard && pnpm build — clean; npx tsc --noEmit — zero errors; pnpm test — 15/15 passing
• pnpm build && pnpm test from repo root — cli 917/917, dashboard 15/15, server 677/677, zero errors

🤖 Generated with Claude Code