Staff report: compact rows, anchor nav, Civi file links, Y1 matrix

UX iteration after first live look:
- Sticky anchor strip below the header with a chip per section (incl.
  Submissions) so staff can jump around a long page.
- Compact one-line rows that show only the latest value; multi-history
  fields get a muted 'N earlier entries' toggle that reveals the rest
  inline. Same affordance for file fields.
- Empty fields collapse under a single 'N empty fields' toggle per
  section instead of taking a row each.
- Stage 5: Y1_Q<n>_<metric> fields render as a read-only matrix table
  (rows: metrics; columns: Q1..Q4) matching the form's matrix layout.

File proxy (/api/staff/file) deleted. APIv4 Attachment isn't exposed
on this Civi instance (per the June upload spike), which is why the
previous proxy returned broken images. Staff are already authenticated
to Civi when they arrive here, so file fields now render as outbound
links to CIVI_BASE_URL/civicrm/file?reset=1&id=<id> and the browser
uses the staff session. No more proxy auth, no more SSRF surface to
harden, no broken images.

CIVI_BASE_URL flows from the staff page (server component) into the
client as a prop. No secret material crosses the boundary.

app/staff/report/page.tsx

@@ -23,6 +23,9 @@ export default async function StaffReportPage({ searchParams }: PageProps) {
 
   const orgId = Number(org);
   const orgValid = !!org && Number.isFinite(orgId) && orgId > 0;
+  // CIVI_BASE_URL flows from server config to client only as a base for
+  // outbound file links. No secret material is exposed.
+  const civiBaseUrl = process.env.CIVI_BASE_URL ?? "";
 
   return (
     <>
@@ -37,7 +40,7 @@ export default async function StaffReportPage({ searchParams }: PageProps) {
         <div className="mx-auto max-w-5xl px-4 py-10 sm:px-6 sm:py-14">
           {orgValid ? (
             <Suspense fallback={null}>
-              <StaffReportView org={orgId} authKey={key!} />
+              <StaffReportView org={orgId} authKey={key!} civiBaseUrl={civiBaseUrl} />
             </Suspense>
           ) : (
             <MissingOrg />