Security Audit & Engineering Hardening

A full security audit round: payment webhook verification bypass and newsletter XSS fixed, plus startup env validation, baseline security headers, unified error handling, three-level error boundaries, and CI with regression tests.

This release completes a security audit across authentication, billing, and infrastructure, and raises the engineering quality baseline across the board.

Security Fixes

Closed a payment bypass: Creem and Stripe webhooks no longer fall back to parsing unverified bodies when no secret is configured — production now requires a webhook secret (mirroring the existing Dodo guard), with gateway security tests included.
Fixed reflected XSS on the newsletter unsubscribe page and replaced the token scheme with HMAC-SHA256 signed tokens (constant-time comparison), so unsubscribe links can no longer be forged.
All routes now send baseline security headers: HSTS, X-Frame-Options SAMEORIGIN, nosniff, Referrer-Policy, and a restrictive Permissions-Policy.

Reliability & Engineering Quality

Server environment variables are validated at startup, so misconfigured deployments fail fast with clear errors instead of breaking mid-request.
Three levels of App Router error boundaries (route/app/global) show localized error pages; auth emails (OTP, magic link, password reset) report real errors instead of silent success when delivery fails; the Hono API gained a central error handler and a request-body size limit.
A CI workflow runs type-check/lint/unit on every push, Playwright e2e now runs against a production build with retries, and the webhook-to-entitlement chain has regression tests.

This release completes a security audit across authentication, billing, and infrastructure, and raises the engineering quality baseline across the board.

Security Fixes

Closed a payment bypass: Creem and Stripe webhooks no longer fall back to parsing unverified bodies when no secret is configured — production now requires a webhook secret (mirroring the existing Dodo guard), with gateway security tests included.
Fixed reflected XSS on the newsletter unsubscribe page and replaced the token scheme with HMAC-SHA256 signed tokens (constant-time comparison), so unsubscribe links can no longer be forged.
All routes now send baseline security headers: HSTS, X-Frame-Options SAMEORIGIN, nosniff, Referrer-Policy, and a restrictive Permissions-Policy.

Reliability & Engineering Quality

Server environment variables are validated at startup, so misconfigured deployments fail fast with clear errors instead of breaking mid-request.
Three levels of App Router error boundaries (route/app/global) show localized error pages; auth emails (OTP, magic link, password reset) report real errors instead of silent success when delivery fails; the Hono API gained a central error handler and a request-body size limit.
A CI workflow runs type-check/lint/unit on every push, Playwright e2e now runs against a production build with retries, and the webhook-to-entitlement chain has regression tests.