fix(review): close 5 follow-up gaps from Stage 6 audit re-review

- F-T-003 actually closed: clients/typescript/src/subscribe.ts now
  bounds the 401-refresh loop at 3 consecutive refusals, surfaces an
  onError describing the loop, and resets on any successful stream
  open. New test covers the cap. The Stage 2 dashboard fix only
  addressed adminRequest in dashboard/src/lib/api.ts; the originally-
  cited TS client file was untouched.

- users/invitations subtab dropped the redundant api.apps.get fetch
  the other 5 subtabs already shed in Stage 6.

- Queue visibility-timeout validator pulled out as
  validate_queue_visibility_timeout, with two thresholds: hard-reject
  below MIN_QUEUE_VISIBILITY_TIMEOUT_SECS (30s — catches typos), warn-
  log between MIN and SAFE_VISIBILITY_VS_EXEC_BUDGET_SECS (300s) so
  operators see when their visibility is below the dispatcher's
  per-message executor budget. Stage 6 only had the hard floor; the
  reviewer caught that a 60s handler still races a 30s visibility
  even after the floor. Four new unit tests cover none/above-safe/
  between/below-min.

- pic dead-letters count subcommand: cheap headless probe for
  unresolved DL totals, parallels the dashboard's badge query.

- pic dead-letters replay now has a happy-path integration test
  (replay_against_real_dl_row_succeeds): inserts a synthetic DL row
  directly via the rust-postgres sync driver (added as dev-dep),
  drives `pic dead-letters replay`, asserts the row is resolved with
  reason=replayed and count drops back to 0. Plus a count smoke test.

All 75 CLI integration tests + 16 TS client tests + 4 new
visibility-timeout unit tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -399,6 +399,18 @@ impl Client {
         decode(resp).await
     }
 
+    /// `GET /api/v1/admin/apps/{id}/dead_letters/count`
+    pub async fn dead_letters_count(&self, app: &str) -> Result<DeadLetterCountDto> {
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/apps/{app}/dead_letters/count"),
+            )
+            .send()
+            .await?;
+        decode(resp).await
+    }
+
     /// `GET /api/v1/admin/apps/{id}/dead_letters?unresolved={bool}&limit={n}`
     pub async fn dead_letters_list(
         &self,
@@ -647,6 +659,11 @@ pub struct TriggerDto {
     pub details: Value,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct DeadLetterCountDto {
+    pub unresolved: i64,
+}
+
 #[derive(Debug, Deserialize)]
 pub struct DeadLetterListDto {
     pub dead_letters: Vec<DeadLetterDto>,

crates/picloud-cli/src/cmds/dead_letters.rs

@@ -6,6 +6,18 @@ use crate::client::Client;
 use crate::config;
 use crate::output::{KvBlock, OutputMode, Table};
 
+/// `pic dead-letters count --app <slug>` — print the unresolved DL
+/// count for an app. Useful for headless probes (alerting / dashboards).
+pub async fn count(app: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let resp = client.dead_letters_count(app).await?;
+    let mut table = Table::new(["unresolved"]);
+    table.row([resp.unresolved.to_string()]);
+    table.print(mode);
+    Ok(())
+}
+
 pub async fn ls(app: &str, unresolved: bool, limit: u32, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;

crates/picloud-cli/src/main.rs

@@ -466,6 +466,13 @@ enum TriggersCmd {
 
 #[derive(Subcommand)]
 enum DeadLettersCmd {
+    /// Print the unresolved DL count. Cheap probe for alerting /
+    /// dashboards — no row payloads, just the bare integer.
+    Count {
+        #[arg(long)]
+        app: String,
+    },
+
     /// List dead-letter rows for an app.
     Ls {
         #[arg(long)]
@@ -822,6 +829,9 @@ async fn main() -> ExitCode {
         Cmd::Triggers {
             cmd: TriggersCmd::CreateFromJson { app, kind, body },
         } => cmds::triggers::create_from_json(&app, &kind, &body, mode).await,
+        Cmd::DeadLetters {
+            cmd: DeadLettersCmd::Count { app },
+        } => cmds::dead_letters::count(&app, mode).await,
         Cmd::DeadLetters {
             cmd:
                 DeadLettersCmd::Ls {