Add event report dashboard, slide-out drawer, in-app comp portal + creator tracking

- Reporting: GET /api/stats aggregates check-in progress, ice, ticket types,
  people breakdown, add-ons/donors, gate-crew leaderboard (from audit),
  comp tickets by creator, and a by-hour check-in timeline. New /stats screen.
- Slide-out drawer (custom RN Animated, no new native deps) replaces per-screen
  header links; available on every main screen via a hamburger.
- In-app comp portal (/comp), password-gated like /crush33, reusing the portal
  endpoints; records the issuing gate-staff name (Created By column) and reports
  comps per creator.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/lib/api.ts

@@ -22,6 +22,7 @@ export interface TicketView {
   name: string;
   email: string;
   ticketType: string;
+  createdBy: string;
   total: number;
   redeemed: number;
   remaining: number;
@@ -194,6 +195,63 @@ export interface AuditEntry {
   action: "check-in" | "undo" | "ice" | "ice-undo";
 }
 
+export interface Stats {
+  orders: number;
+  tickets: { total: number; redeemed: number; remaining: number; pct: number };
+  people: { adults: number; youth: number; kids12: number; kids9: number; kids4Free: number };
+  ice: { total: number; redeemed: number; remaining: number; pct: number; ticketsSold: number };
+  types: { type: string; count: number; total: number; redeemed: number }[];
+  donors: { orders: number; members: number; vouchers: number };
+  extras: { carParking: number; rvParking: number; utv: number };
+  comps: { total: number; byCreator: { name: string; count: number }[] };
+  operators: { name: string; checkins: number; ice: number; undos: number }[];
+  checkinsByHour: { hour: string; count: number }[];
+  generatedAt: string;
+}
+
+export function getStats(force = false): Promise<Stats> {
+  return authed<Stats>(`/api/stats${force ? "?force=1" : ""}`);
+}
+
+// Comp-ticket portal (password-gated; separate from the staff PIN).
+export async function portalVerify(password: string): Promise<{ ok: boolean; types: string[] }> {
+  const res = await fetch(`${API_BASE}/api/portal/verify`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password }),
+  });
+  if (res.status === 401) throw new AuthError("Wrong password");
+  if (!res.ok) throw new ApiError(`Verify failed (${res.status})`);
+  return res.json();
+}
+
+export interface PortalTicket {
+  ok: boolean;
+  code: string;
+  type: string;
+  name: string;
+  emailSent: boolean;
+  qr: string; // data URL
+}
+
+export async function portalCreate(input: {
+  password: string;
+  name: string;
+  email: string;
+  type: string;
+  createdBy?: string;
+}): Promise<PortalTicket> {
+  const res = await fetch(`${API_BASE}/api/portal/create-ticket`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input),
+  });
+  if (res.status === 401) throw new AuthError("Wrong password");
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) throw new ApiError(body?.detail ?? body?.error ?? `Create failed (${res.status})`);
+  return body;
+}
+
 export function getAudit(opts: { code?: string; limit?: number } = {}): Promise<{
   enabled: boolean;
   entries: AuditEntry[];