Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/src/routes/contact.ts

@@ -1,7 +1,8 @@
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import { getDb, contactMessages } from '@lawdesk/db';
-import { sendEmail, contactAckEmail } from '../lib/email';
+import { sendEmail, contactAckEmail, contactNotifyEmail } from '../lib/email';
+import { env } from '../env';
 
 const contactBody = z.object({
   fullName: z.string().min(1).max(120).trim(),
@@ -27,6 +28,18 @@ export async function contactRoutes(app: FastifyInstance) {
       sendEmail({ to: body.email, ...tpl }).catch((err) =>
         app.log.warn({ err }, 'contact ack email failed'),
       );
+      // Notify the team — reply-to points at the submitter so answering is one click.
+      const notify = contactNotifyEmail({
+        fromName: body.fullName,
+        fromEmail: body.email,
+        message: body.message,
+        ip: req.ip ?? null,
+      });
+      for (const admin of env.superadminEmails) {
+        sendEmail({ to: admin, ...notify, replyTo: body.email }).catch((err) =>
+          app.log.warn({ err }, 'contact notify email failed'),
+        );
+      }
       return reply.code(201).send({ ok: true });
     },
   );