Add e2e auth test suite, retention crons, and email-verification UX

- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
  Fastify app against a disposable Dockerized Postgres (never a real DB) and
  covers signup/login/lockout/rate limits, CSRF (incl. forged-token
  rejection), logout, password reset, email verification, the superadmin
  verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
  don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
  tokens, login attempts, tool usage, contact messages, audit log) +
  sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
  with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
  document login-attempt/tool-usage retention in the Privacy Policy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/README.md

@@ -0,0 +1,28 @@
+# Operational scripts
+
+All scripts load `.env` from the repo root and run against the **live** database/bucket —
+there is no staging environment. Run them from the monorepo root.
+
+## Scheduled jobs (set up as daily crons on the production server)
+
+```cron
+# Daily at 03:00 — enforce Privacy Policy retention windows
+0 3 * * * cd /path/to/app && npm run cron:retention >> logs/retention.log 2>&1
+
+# Daily at 08:00 — mark past-due invoices overdue + email client reminders
+0 8 * * * cd /path/to/app && npm run cron:overdue >> logs/overdue.log 2>&1
+```
+
+| Script | npm alias | What it does |
+| --- | --- | --- |
+| `retention-sweep.ts` | `npm run cron:retention` | Purges expired sessions, consumed/expired reset & verification tokens, login attempts and tool usage > 90 days, contact messages and audit log > 24 months. |
+| `send-overdue-reminders.ts` | `npm run cron:overdue` | Flips past-due `sent` invoices to `overdue` and emails the client once, on the transition. |
+
+## Maintenance / one-off
+
+| Script | npm alias | What it does |
+| --- | --- | --- |
+| `sweep-orphaned-storage.ts` | `npm run storage:sweep` | Reconciles DO Spaces against the `documents` table. Dry-run by default; add `-- --delete` to remove orphans. Only document-shaped keys (`uuid/uuid/uuid.ext`) are ever deleted. |
+| `create-admin.ts` | — | Creates a superadmin user (credentials via env/argv). |
+| `seed-demo.ts` | — | Seeds demo data. **Live DB — use with care.** |
+| `migrate-storage-to-spaces.ts` | — | One-time migration of legacy local files to Spaces (historical). |

scripts/retention-sweep.ts

@@ -0,0 +1,79 @@
+// Enforces the data-retention windows promised in the Privacy Policy. Run daily:
+//   npx tsx scripts/retention-sweep.ts
+//
+// Windows enforced:
+//   - sessions: expired                          → deleted
+//   - password resets / email verifications: consumed or expired → deleted
+//   - login attempts (email, IP): 90 days
+//   - tool usage (IP): 90 days
+//   - contact messages: 24 months
+//   - audit log: 24 months
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import dotenv from 'dotenv';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, '../.env') });
+
+import { isNotNull, lt, or } from 'drizzle-orm';
+import {
+  getDb,
+  getPool,
+  sessions,
+  passwordResets,
+  emailVerifications,
+  loginAttempts,
+  contactMessages,
+  toolUsage,
+  auditLog,
+} from '@lawdesk/db';
+
+function daysAgo(n: number): Date {
+  return new Date(Date.now() - n * 24 * 60 * 60 * 1000);
+}
+
+async function main() {
+  const db = getDb();
+  const now = new Date();
+
+  const report: Array<[string, number]> = [];
+  const run = async (label: string, fn: () => Promise<{ rowCount?: number | null }>) => {
+    const res = await fn();
+    report.push([label, res.rowCount ?? 0]);
+  };
+
+  await run('expired sessions', () => db.delete(sessions).where(lt(sessions.expiresAt, now)));
+  await run('consumed/expired password resets', () =>
+    db
+      .delete(passwordResets)
+      .where(or(isNotNull(passwordResets.consumedAt), lt(passwordResets.expiresAt, now))),
+  );
+  await run('consumed/expired email verifications', () =>
+    db
+      .delete(emailVerifications)
+      .where(or(isNotNull(emailVerifications.consumedAt), lt(emailVerifications.expiresAt, now))),
+  );
+  await run('login attempts > 90 days', () =>
+    db.delete(loginAttempts).where(lt(loginAttempts.attemptedAt, daysAgo(90))),
+  );
+  await run('tool usage > 90 days', () =>
+    db.delete(toolUsage).where(lt(toolUsage.createdAt, daysAgo(90))),
+  );
+  await run('contact messages > 24 months', () =>
+    db.delete(contactMessages).where(lt(contactMessages.createdAt, daysAgo(730))),
+  );
+  await run('audit log > 24 months', () =>
+    db.delete(auditLog).where(lt(auditLog.createdAt, daysAgo(730))),
+  );
+
+  console.log('Retention sweep complete:');
+  for (const [label, count] of report) console.log(`  ${label}: ${count} row(s) deleted`);
+
+  await getPool().end();
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

scripts/sweep-orphaned-storage.ts

@@ -0,0 +1,75 @@
+// Reconciles DO Spaces against the documents table and reports/deletes orphaned objects —
+// files whose DB rows were removed before storage cleanup existed (deleted firms/cases/clients).
+//
+//   Dry run (default):  npx tsx scripts/sweep-orphaned-storage.ts
+//   Actually delete:    npx tsx scripts/sweep-orphaned-storage.ts --delete
+//
+// Only keys matching the document layout `<uuid>/<uuid>/<uuid>.<ext>` are eligible for
+// deletion; anything else in the bucket is reported but never touched.
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import dotenv from 'dotenv';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, '../.env') });
+
+import { getDb, getPool, documents } from '@lawdesk/db';
+import { listAllKeys, deleteFile } from '../apps/api/src/lib/storage';
+
+const DELETE = process.argv.includes('--delete');
+const UUID = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
+const DOC_KEY = new RegExp(`^${UUID}/${UUID}/${UUID}(\\.[A-Za-z0-9]+)?$`, 'i');
+
+async function main() {
+  const db = getDb();
+
+  console.log('Listing bucket contents...');
+  const bucketKeys = await listAllKeys();
+  console.log(`  ${bucketKeys.length} object(s) in bucket.`);
+
+  const rows = await db.select({ storageKey: documents.storageKey }).from(documents);
+  const dbKeys = new Set(rows.map((r) => r.storageKey));
+  console.log(`  ${dbKeys.size} document row(s) in database.`);
+
+  const orphans: string[] = [];
+  const unrecognized: string[] = [];
+  for (const key of bucketKeys) {
+    if (dbKeys.has(key)) continue;
+    if (DOC_KEY.test(key)) orphans.push(key);
+    else unrecognized.push(key);
+  }
+
+  // Reverse check: DB rows whose file is missing from the bucket (report only).
+  const bucketSet = new Set(bucketKeys);
+  const missing = [...dbKeys].filter((k) => !bucketSet.has(k));
+
+  console.log(`\nOrphaned objects (in bucket, no DB row): ${orphans.length}`);
+  for (const k of orphans) console.log(`  ${k}`);
+  if (unrecognized.length) {
+    console.log(`\nUnrecognized keys (not document-shaped — never deleted): ${unrecognized.length}`);
+    for (const k of unrecognized) console.log(`  ${k}`);
+  }
+  if (missing.length) {
+    console.log(`\nWARNING — DB rows whose file is MISSING from the bucket: ${missing.length}`);
+    for (const k of missing) console.log(`  ${k}`);
+  }
+
+  if (!DELETE) {
+    console.log(`\nDry run — nothing deleted. Re-run with --delete to remove the ${orphans.length} orphan(s).`);
+  } else {
+    let deleted = 0;
+    for (const key of orphans) {
+      await deleteFile(key);
+      deleted++;
+    }
+    console.log(`\nDeleted ${deleted} orphaned object(s).`);
+  }
+
+  await getPool().end();
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});