admin: draw the overview charts with visx

the hand-written scale, tick, stacking and arc math is replaced by visx 4.0.0
primitives; rendering, colours and themes stay the app's own. all four charts
share one hover treatment: the client chart gains the tooltip and dimming the
query timeline had, the donuts gain both, an open tooltip follows a data
refresh instead of going stale, and it retires when the window rolls. the
timeline's third series is named allowed instead of other, and the client
chart's other aggregate disappears from a window where it counted nothing.
licenses gain the isc text for the bundled d3 modules.

licenses/inventory.zon

@@ -71,6 +71,25 @@
 // a `sources` list — no guard would raise it, which is why it is written down
 // here.
 //
+// Twenty-three more joined the not-shipped list with visx, and the sourcemap
+// build settled which. Fourteen are types only and emit no runtime code at all:
+// @types/d3-array, @types/d3-color, @types/d3-delaunay, @types/d3-format,
+// @types/d3-geo, @types/d3-interpolate, @types/d3-path, @types/d3-scale,
+// @types/d3-shape, @types/d3-time, @types/d3-time-format, @types/geojson,
+// @types/react and @types/react-dom, with csstype under them. They are in the
+// runtime closure rather than among the devDependencies only because the @visx
+// packages declare them as ordinary dependencies. @visx/curve is the curve
+// factory the line and area shapes take, which these charts do not draw.
+// @visx/vendor is the one worth stating plainly: it is a re-export shim over the
+// d3 modules, npm records it as `MIT and ISC` because of what it re-exports, and
+// the bundler resolves straight through it to the d3 packages themselves — so
+// its own bytes never reach admin/dist and the d3 entry below is what covers the
+// code that does. d3-delaunay, d3-geo, d3-time-format, delaunator and
+// robust-predicates are the map and Voronoi half of that shim, which no chart
+// here imports; the first four are ISC and robust-predicates is Unlicense.
+// react-use-measure is the resize hook @visx/responsive uses, and this app keeps
+// its own, so nothing pulls it in.
+//
 // Of the remaining devDependencies, none puts a byte in admin/dist: @vitejs/
 // plugin-react and typescript only transform our own sources (react-refresh is
 // dev-server only, and tslib is optional and unused), lightningcss only
@@ -155,6 +174,48 @@
         .note = "Bundled into the admin UI JavaScript. Separate entry from the other TanStack packages: same MIT text, different copyright line.",
         .file = "tanstack-store-mit.txt",
     },
+    .{
+        .component = "visx (@visx/axis, @visx/bounds, @visx/grid, @visx/group, @visx/point, @visx/scale, @visx/shape, @visx/text, @visx/tooltip)",
+        .version = "@visx/axis 4.0.0, @visx/bounds 4.0.0, @visx/grid 4.0.0, @visx/group 4.0.0, @visx/point 4.0.0, @visx/scale 4.0.0, @visx/shape 4.0.0, @visx/text 4.0.0, @visx/tooltip 4.0.0",
+        .note = "The chart primitives the Overview charts are drawn with — scales, stacked bars, pie arcs, axes, grid and tooltip — bundled into the admin UI JavaScript. Nine of the eleven @visx packages in the closure ship; @visx/curve and @visx/vendor do not (see the note at the head of this file). All nine carry a byte-identical MIT text. In the tarballs and in the image.",
+        .file = "visx-mit.txt",
+    },
+    .{
+        .component = "d3 (d3-array, d3-color, d3-format, d3-interpolate, d3-path, d3-scale, d3-shape, d3-time, internmap)",
+        .version = "d3-array 3.2.1, d3-color 3.1.0, d3-format 3.1.0, d3-interpolate 3.0.1, d3-path 3.1.0, d3-scale 4.0.2, d3-shape 3.2.0, d3-time 3.1.0, internmap 2.0.3",
+        .note = "The scale, colour, number-format and path arithmetic behind visx, bundled into the admin UI JavaScript. They arrive through @visx/vendor, which re-exports them without contributing bytes of its own, so these nine are what the bundle actually carries. The first ISC dependencies this project has taken: Mokhtar Mial accepted ISC inbound for nxdns on 2026-08-24, which is the decision that let them ship. ISC asks only that the copyright notice and the permission notice travel with the copies; the nine notices differ in their copyright years alone, so the file below reproduces every notice above the single shared permission text. In the tarballs and in the image.",
+        .file = "d3-isc.txt",
+    },
+    .{
+        .component = "classnames",
+        .version = "classnames 2.5.1",
+        .note = "The class-name joiner visx uses to merge its own chart class names with a caller's. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
+        .file = "classnames-mit.txt",
+    },
+    .{
+        .component = "balanced-match",
+        .version = "balanced-match 0.4.2, balanced-match 1.0.2",
+        .note = "The bracket matcher reduce-function-call calls when it takes a CSS calc() expression apart. Bundled into the admin UI JavaScript. Two versions are installed, one under reduce-function-call and one at the root; both carry this text. Separate entry from the other MIT packages: same MIT text, different copyright line.",
+        .file = "balanced-match-mit.txt",
+    },
+    .{
+        .component = "math-expression-evaluator",
+        .version = "math-expression-evaluator 1.4.0",
+        .note = "The arithmetic evaluator reduce-css-calc reduces a calc() expression with, reached from @visx/text's width measurement. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
+        .file = "math-expression-evaluator-mit.txt",
+    },
+    .{
+        .component = "reduce-css-calc",
+        .version = "reduce-css-calc 1.3.0",
+        .note = "Resolves CSS calc() expressions for @visx/text. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
+        .file = "reduce-css-calc-mit.txt",
+    },
+    .{
+        .component = "reduce-function-call",
+        .version = "reduce-function-call 1.0.3",
+        .note = "The function-call walker reduce-css-calc is built on. Bundled into the admin UI JavaScript. Separate entry from reduce-css-calc: same MIT text, different copyright line.",
+        .file = "reduce-function-call-mit.txt",
+    },
     .{
         .component = "Vite",
         .version = "vite 8.1.5",