Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/create-admin.ts

@@ -0,0 +1,71 @@
+// One-off: creates a superadmin user.
+// Run from monorepo root: npx tsx scripts/create-admin.ts
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import dotenv from 'dotenv';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, '../.env') });
+
+import argon2 from 'argon2';
+import { eq } from 'drizzle-orm';
+import { getDb, getPool, users } from '@lawdesk/db';
+
+// Credentials come from the environment or argv — never hardcode them in a tracked file.
+//   ADMIN_EMAIL=you@example.com ADMIN_PASSWORD='...' ADMIN_NAME='You' npx tsx scripts/create-admin.ts
+//   or: npx tsx scripts/create-admin.ts you@example.com 'password' 'Your Name'
+const EMAIL = process.env.ADMIN_EMAIL ?? process.argv[2];
+const PASSWORD = process.env.ADMIN_PASSWORD ?? process.argv[3];
+const NAME = process.env.ADMIN_NAME ?? process.argv[4] ?? 'Admin';
+
+if (!EMAIL || !PASSWORD) {
+  console.error(
+    'Missing credentials.\n' +
+      "Usage: ADMIN_EMAIL=you@example.com ADMIN_PASSWORD='...' [ADMIN_NAME='...'] npx tsx scripts/create-admin.ts",
+  );
+  process.exit(1);
+}
+if (PASSWORD.length < 10) {
+  console.error('ADMIN_PASSWORD must be at least 10 characters.');
+  process.exit(1);
+}
+
+async function main() {
+  const db = getDb();
+  const passwordHash = await argon2.hash(PASSWORD, {
+    type: argon2.argon2id,
+    memoryCost: 64 * 1024,
+    timeCost: 3,
+    parallelism: 1,
+  });
+
+  const existing = await db.select({ id: users.id }).from(users).where(eq(users.email, EMAIL));
+  if (existing.length > 0) {
+    await db.update(users).set({
+      passwordHash,
+      isSuperadmin: true,
+      isSuspended: false,
+      emailVerifiedAt: new Date(),
+      updatedAt: new Date(),
+    }).where(eq(users.email, EMAIL));
+    console.log(`Updated existing user → superadmin: ${EMAIL}`);
+  } else {
+    const [u] = await db.insert(users).values({
+      email: EMAIL,
+      passwordHash,
+      fullName: NAME,
+      role: 'owner',
+      isSuperadmin: true,
+      emailVerifiedAt: new Date(),
+    }).returning();
+    console.log(`Created superadmin: ${u.email} (id: ${u.id})`);
+  }
+
+  await getPool().end();
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});