Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -22,16 +22,28 @@ DATABASE_URL=postgresql://doadmin:password@db-postgresql-nyc1-xxxxx.b.db.ondigit
 DATABASE_CA_CERT_PATH=./certs/do-ca.crt
 
 # ─────────────────────────────────────────────
-# Local file storage
-# Absolute path where uploaded documents are stored (outside web root).
-# Production example: /var/www/vhosts/elegalsoftware.com/storage
+# Object storage — DigitalOcean Spaces (S3-compatible). Sole storage backend (required).
+# Create a Space + access keys in the DO console. Endpoint is the REGION endpoint
+# (no bucket prefix); the SDK adds the bucket as a virtual host.
 # ─────────────────────────────────────────────
+SPACES_ENDPOINT=https://nyc3.digitaloceanspaces.com
+SPACES_REGION=nyc3
+SPACES_BUCKET=elegalsoftware
+SPACES_KEY=
+SPACES_SECRET=
+# Optional CDN/base URL for public objects; leave blank to serve everything through the API.
+SPACES_PUBLIC_BASE=
+
+# Legacy local path — only read by scripts/migrate-storage-to-spaces.ts during a one-time migration.
 STORAGE_PATH=./storage
 
 # ─────────────────────────────────────────────
-# Email (Resend)
+# Email (SMTP2GO) — sends all platform email via the HTTP API.
+# Create an API key in the SMTP2GO dashboard (Settings → API Keys).
+# EMAIL_FROM's domain must be a verified sender domain in SMTP2GO.
+# Leave the key blank in dev to log emails instead of sending.
 # ─────────────────────────────────────────────
-RESEND_API_KEY=
+SMTP2GO_API_KEY=
 EMAIL_FROM="eLegal Software <noreply@yourdomain.com>"
 
 # ─────────────────────────────────────────────