Feat: Add the "Essential work done through the kit" card to /impact (T433621, MR 1/4)

First of the stacked T433621 MRs (card + kit-action tiles now; aggregation subsystem + reach tiles follow). Stacked on !156 (merged) — auto-retargets as the stack merges.

Ships: the EssentialWorkCard at the bottom of /impact with the four kit-action tiles — HotCat gadget installs, infoboxes imported, main pages customized, recruit shares initiated — each backed by analytics-event queries with the standard days window + production exclusions, plus a public outputs drill-down dialog per drillable tile.

Key design points:
1. Headline == drill-down list by construction: each tile's items query shares the count's predicates verbatim, DISTINCT at the dialog's row grain.
2. The items endpoint is PUBLIC (requireUser): rows are page titles/links/dates only, never usernames — a deliberate, documented divergence from the maintainer-only drill-downs.
3. A tile absent from the payload is simply not shipped yet — the client renders only present keys, so the follow-up MRs ship reach tiles without flags.
4. New server/services/wiki-links.js centralizes page-URL encoding (unicode-safe); the client never builds wiki URLs.

Verified: scratch-DB smoke in dev AND production modes (admin/test-wiki exclusions, dedup semantics, count==items.length, username-free payloads, unicode URL round-trip); express boot + route gating smoke; eslint/prettier/build clean.

Closes T433621