Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/src/routes/invoices.ts

@@ -14,7 +14,7 @@ import { loadFirm } from '../lib/firm';
 import { assertCanCreateInvoice, PlanLimitError } from '../lib/plan-limits';
 import { nextInvoiceNumber } from '../lib/invoice-numbering';
 import { renderInvoicePdf } from '../lib/invoice-pdf';
-import { sendEmail, invoiceEmail } from '../lib/email';
+import { sendEmail, invoiceEmail, invoicePaidEmail } from '../lib/email';
 
 const STATUSES = ['draft', 'sent', 'paid', 'overdue', 'void'] as const;
 
@@ -262,9 +262,11 @@ export async function invoicesRoutes(app: FastifyInstance) {
 
     const taxRate = body.taxRate;
     const totals = computeTotals(accumulated, taxRate);
-    const number = await nextInvoiceNumber(firmId);
 
     const created = await db.transaction(async (tx) => {
+      // Generate the number inside the transaction: the advisory lock it takes must be held
+      // until this insert commits, so concurrent creates serialise and never collide.
+      const number = await nextInvoiceNumber(tx, firmId);
       const [inv] = await tx
         .insert(invoices)
         .values({
@@ -461,6 +463,32 @@ export async function invoicesRoutes(app: FastifyInstance) {
       .set({ status: 'paid', paidAt: now, updatedAt: now })
       .where(eq(invoices.id, id))
       .returning();
+
+    // Payment receipt to the client (best-effort).
+    if (row) {
+      try {
+        const [client] = await db.select().from(clients).where(eq(clients.id, row.clientId)).limit(1);
+        const [firm] = await db.select().from(firms).where(eq(firms.id, firmId)).limit(1);
+        if (client?.email && firm) {
+          const totalFmt = new Intl.NumberFormat('en-US', {
+            style: 'currency',
+            currency: 'USD',
+          }).format(Number(row.total));
+          const tpl = invoicePaidEmail({
+            clientName: client.name,
+            firmName: firm.name,
+            invoiceNumber: row.number,
+            total: totalFmt,
+          });
+          sendEmail({ to: client.email, ...tpl }).catch((err) =>
+            app.log.warn({ err, invoiceId: id }, 'invoice paid email failed'),
+          );
+        }
+      } catch (err) {
+        app.log.warn({ err, invoiceId: id }, 'failed to send invoice paid email');
+      }
+    }
+
     return row;
   });