Featurebase: sanitize page titles in v3 to avoid leaking names/IDs in dashboard recent views

Problem

In the Featurebase dashboard, under recent page visits, page titles show raw route segments (including dynamic names/IDs) because v3 dashboard pages don't set document.title. Featurebase's SDK falls back to the URL path, which is how names/titles end up surfaced in the Featurebase admin view.

Pointed out by Laura in #dev (Slack thread 2026-04-24): "Featurebase reads the page title we give to our pages, but we are actually not giving titles to pages on v3."

Goal

In Featurebase dashboard → recent page visits, each entry should display something like Whisperit · {sanitized title} — never a raw user name, doc name, client name, or other PII.
Fix in a single file (messenger component) — do NOT add metadata.title to all 30 v3 route files. Ankan's constraint.
Metadata on individual pages already looks fine; only the Featurebase-visible title needs to change.

Proposed approach

In dashboard/app/.../featurebase-messenger.tsx:

Use usePathname() to get the current route.
Sanitize it: strip UUIDs, numeric IDs, and any dynamic segments that could contain PII.
Set document.title = \Whisperit · ${sanitized}`on every route change (viauseEffectonpathname`).
Re-trigger Featurebase's changeLocale/identify (or equivalent) so the SDK picks up the new title on SPA navigations.

Example sanitizer:

const sanitized = pathname
  .replace(/\/[0-9a-f-]{36}/gi, '')   // strip UUIDs
  .replace(/\/\d+/g, '')              // strip numeric IDs
  .split('/').filter(Boolean)
  .map(seg => seg.charAt(0).toUpperCase() + seg.slice(1))
  .join(' · ') || 'Dashboard';
document.title = `Whisperit · ${sanitized}`;

Security / privacy requirements

No PII in titles: no client names, document names, user names, emails, IDs.
Whitelist of allowed route segments if possible; everything else becomes a generic label.
Verify in Featurebase dashboard (recent page visits) after deploy that titles are clean.

Acceptance criteria

[X] Single-file change (messenger component only)
[ ] Featurebase dashboard recent page visits show Whisperit · {sanitized-route} format
[ ] No UUIDs, numeric IDs, or user-provided strings visible in any Featurebase-surfaced title
[ ] Titles update correctly on client-side navigation (not just hard reloads)
[ ] QA: manually inspect 5+ routes (incl. dynamic ones like /documents/[id], /clients/[id]) in Featurebase admin

Context

Slack thread: https://whisperit.slack.com/archives/C07BDM0LY14/p1777034773852469
Related: earlier Featurebase HMAC work (/api/featurebase/hash route) — keep existing auth flow intact.

Whisperit