fix(compat): kill dead clicks on accept dialog and dashboard banners

[posthog-eu]

Summary

Two dead-click traps and one silent write on the compatibility-acceptance journey.

Problem

• Accept dialog: users click Accept, nothing happens, they give up — the button was always enabled but the handler bailed with a toast (rendered elsewhere) whenever the reason was empty. Nothing on the field said a reason was required.
• Dashboard banners: only the small CTA button was clickable; the card's icon/heading/count were inert markup, so clicks on the obvious big target did nothing. Affected CompatibilityBanner and the identically-shaped ReleaseBanner ("View adoption").
• acknowledge_compatibility_event returned silently on an RBAC denial, so users below release-manager got a success toast for a write that never happened.

Changes

Area	Fix
Accept dialog ([app].observe.compatibility.vue)	Reason is required: confirm button disabled until it has content, field marked * + required + autofocused, validation shown inline on the field instead of as a toast.
Banners (CompatibilityBanner.vue, ReleaseBanner.vue)	Whole card is now the click target — cursor-pointer, hover, keyboard-operable (role="button", Enter/Space); CTA stays as the visual affordance.
RPC (new migration)	acknowledge_compatibility_event now RAISEs instead of no-op, so the client stops reporting success on a failed write.

Why "not authorized" and "unknown id" raise the same error

acknowledge_compatibility_event is SECURITY DEFINER. Raising a distinct error only when the row exists-but-you-lack-permission would let a caller outside the org probe which sequential event ids exist. Both branches raise the identical not_authorized, preserving the no-existence-oracle property the previous no-op had while still surfacing the failure to the legitimate client. supabase/schemas/prod.sql is treated as read-only reference and was not edited; the change lands as a CLI-generated migration.

Test plan

• bun run lint and bun run typecheck:frontend — pass.
• Updated Playwright e2e (compatibility-events.spec.ts): confirm button is disabled while the reason is empty (no RPC fires) and enables once a reason is typed; banner card still navigates via its data-test hook.
• Updated DB tests (compatibility-events.test.ts): non-member accept and unknown-id both now raise not_authorized and leave the event unresolved. These require a running Supabase (Docker) and were not executed in the authoring sandbox.

Screenshots

Not captured in this environment (no browser/app runtime available here). Behavior is covered by the updated e2e assertions above.

Checklist

• My code follows the code style of this project and passes bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud