fix(admin): prefer non-anonymized map locations

design/us-018-admin-dashboard.md

@@ -3,7 +3,7 @@ type: User Story
 title: Monitor community account activity
 description: Administrators use a server-rendered dashboard to review daily activity, confirmed connections, locations, denials, and risky networks.
 tags: [admin, dashboard, metrics, security, maps, ssr]
-timestamp: 2026-08-02T12:05:27Z
+timestamp: 2026-08-07T22:31:05Z
 story_id: US-018
 status: verified
 ---
@@ -15,7 +15,9 @@ As an administrator, I want an operational dashboard of account and game activit
 # Acceptance Criteria
 
 - [x] The administrator landing page is a dashboard rather than a settings form.
-- [x] A server-rendered Natural Earth overview plots each user's latest observation with valid approximate coordinates.
+- [x] A server-rendered Natural Earth overview plots each user's latest non-anonymized observation with valid approximate coordinates, allowing clear and hosting classifications while excluding VPN, proxy, and Tor observations.
+- [x] When a user's newest coordinate-bearing observation is VPN, proxy, or Tor, the map uses that user's older clear or hosting observation when one exists.
+- [x] A user without a coordinate-bearing clear or hosting observation is counted as unavailable on the map.
 - [x] Administrators can opt into a zoomable OpenStreetMap view without removing the default overview.
 - [x] OpenStreetMap tiles load only after the administrator selects the interactive view and retain required attribution.
 - [x] Map markers show the managed Discord nickname on hover or keyboard focus, link to user records, and have an accessible text-table equivalent.
@@ -31,7 +33,7 @@ As an administrator, I want an operational dashboard of account and game activit
 - [x] Monthly active users count distinct users observed through portal or game activity in the previous 30 days.
 - [x] Monthly active Minecraft accounts count distinct accounts with a confirmed Velocity post-login connection in the previous 30 days.
 - [x] The dashboard shows login denials from the previous 24 hours.
-- [x] Recent VPN, proxy, and Tor observations use enriched ProxyCheck classifications, collapse repeated rows per user, and show counts, sources, and latest activity.
+- [x] Recent VPN, proxy, and Tor observations remain available in the separate network-risk section when excluded from map-location selection.
 - [x] The graph includes an accessible title, description, point labels, and textual values.
 - [x] Dashboard queries and initial rendering execute server-side; only the opt-in pan-and-zoom map hydrates client-side.
 - [x] Deployment-managed guild settings and denial messaging remain available on a dedicated settings page.
@@ -48,8 +50,9 @@ As an administrator, I want an operational dashboard of account and game activit
 # Validation
 
 - Missing-day chart behavior and per-user VPN collapsing are covered by [`apps/web/src/lib/admin-metrics.test.ts`](../apps/web/src/lib/admin-metrics.test.ts).
-- Coordinate parsing, backward-compatible ProxyCheck network parsing, normalized location grouping, projection, count badges, complete grouped tooltips, linked markers, semantic network columns, text fallback, and attribution are covered by the user-world-map tests.
-- The Next.js production build reports the dashboard and database-backed console pages as dynamic server-rendered routes.
+- Coordinate parsing, the clear/hosting map policy, backward-compatible ProxyCheck network parsing, normalized location grouping, projection, count badges, complete grouped tooltips, linked markers, semantic network columns, text fallback, and attribution are covered by the user-location and user-world-map tests.
+- The full test suite passes with 106 tests across 36 files; web type checking and lint pass.
+- The Next.js production build succeeds and reports the dashboard and database-backed console pages as dynamic server-rendered routes.
 
 # Related Stories