fix(app): migrate ChartPanel grid item to the MUI v7 Grid API

[bitsbeyond]

Problem

Since the MUI v7 upgrade (#940), Grid is the former Grid2 and silently ignores the legacy item/xs props. The chart cards in the bottom chart panel therefore collapse to their intrinsic width: the chart svg falls back to the visx default of 300x150, and the time axis gets clipped.

	card width (1024px window, 1 chart)
before	~316px (intrinsic)
after	598px = full panel width, matching v0.4.0-beta.7

Fix

Use the size prop of the new Grid API. One line; the 12/6/4-column logic in mapWidth/spacingForChartCount applies again.

Verification

Measured via DevTools against a live broker: with one chart the card spans the full panel width, with two charts each card takes 50%, same as the released build. yarn test:app unchanged (103 passing, 4 pre-existing failures).

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[bitsbeyond]

Note on the failing checks: every GitHub Actions job on this PR fails inside actions/checkout itself, before any project code runs:

Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. […] To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

Since the workflows here trigger on pull_request_target, checkout now refuses the fork's code in that trusted context, so any PR from a fork will fail the same way regardless of its content. Options on the repo side:

1. run the untrusted jobs (lint/test/build) on plain pull_request and keep pull_request_target only for jobs that genuinely need secrets, or
2. opt in explicitly with allow-unsafe-pr-checkout: true on the checkout step (after reviewing the linked risks), ideally combined with an approval gate for first-time contributors.

Happy to adapt this PR if you prefer a different setup. The same applies to #1115 and #1116.

🤖 Generated with Claude Code