fix: template bugs found in the first product's code

[agjs]

Summary

Tinkercaster was created from the template at cdacac0. This PR diffs every template file it changed since, reads the commit behind each change, keeps the ones that fixed a template bug or gap, and checks each against current main. Everything below was still present on main. The findings are recorded as Report 3 (entries 102–119) in docs/maintenance/product-feedback.md.

Billing

• Paid plans granted nothing. Plans were seeded without plan_features, so a Pro subscriber resolved Free entitlements. One typed catalog (billing.plans.ts) now seeds plans and their features. Pro must give every feature key a value, enforced by the type check and a unit test. Pro grants export, team invites and 10 seats.
• Duplicate subscriptions. Checkout now locks the account row and returns 409 when a live Stripe-backed subscription exists, locally or in Stripe (its webhook may lag). It reuses an open session for the same plan and price. An admin-granted plan does not block buying.
• Delayed payments. checkout.session.completed activates the plan only for paid or no_payment_required. async_payment_succeeded and async_payment_failed settle the rest.
• Smaller gaps. Checkout rejects the Free plan. GET /billing/plans is public, for the public site's pricing page, and works with billing off. The optional STRIPE_PRICE_ID_PRO_YEARLY adds a monthly/yearly choice on the billing page.

Sessions

• Reloads logged users out. After the 15-minute access cookie expired, a reload logged the user out, because /users/me answered { user: null } and the UI refreshes only on 401. It now returns 401 while a refresh cookie exists. The UI refreshes, and an unrecoverable 401 resolves to logged out.
• Revoked refresh cookies. /auth/refresh now clears both cookies when the session is gone.
• Lost write after token expiry. The UI's refresh retry re-read a consumed request body, so the first write after expiry failed. The body is now captured before dispatch.

CI and repo

• Every PR check failed in private repos. dorny/paths-filter lists PR files through the API, which needs pull-requests: read in a private repository. BoringStack is public, so this never showed here, but every PR check failed in Tinkercaster. The permission is added to 14 workflows and enforced by the new lint-meta rule github-actions-paths-filter-permissions.
• pre-push could silently skip a gate. With many changed paths, echo | grep -q under pipefail returned 141 and the gate was skipped without a message. Here-strings replace it everywhere. The hook also unsets inherited GIT_* variables.
• packages/* never reached the images. It now reaches them through a BuildKit packages build context and the dev containers through a read-only mount. packages/README.md keeps the directory present.
• CI. The API suite runs once, agent verification cancels superseded PR runs, and dev mail defaults to Mailpit when the overlay is on.

UI

• Fixes. Verify-email no longer posts its single-use token twice under StrictMode. The billing page polls after a Stripe return. nginx returns 404 for /.well-known/* and missing .json/.txt/.xml.
• Conveniences Tinkercaster added. List errors get a retry, the error page gets a home action, devtools appear only with ?devtools, login returns to the page that asked for it (same-origin paths only), and the test setup gains jsdom stubs.

API housekeeping

• Dev logs. No stack trace for validation errors, since it carried the request body.
• Import cycle. Notification events no longer import the lib/notifications barrel.
• Test cleanup. A test derives every table from the schema and fails when a table is neither cleaned nor allowlisted.

Not adopted (Report 3, entry 119): fast-by-default pre-push and skipping main runs after a verified PR weaken gates by policy. Removing the per-app release workflows would break Compose, which publishes through them.

Test plan

• apps/api: bun run check, then bun run test:coverage against a real Postgres (TEST_DATABASE_URL): 1346 pass, 0 fail, coverage gate passed (86.8% lines)
• apps/ui: bun run validate: 741 tests, build, size budgets, lint-meta, knip, format
• apps/docs: bun run build:ci
• bun run agent:check (101 pass), bun test infra/k3s/tests scripts/release, Compose guardrails, shellcheck, actionlint (only style notes already on main)
• nginx config: nginx -t on the pinned image, and a throwaway container answered 404 for /.well-known/security.txt and 200 for SPA routes
• packages/ build context: a scratch app importing a package built with --build-context packages, and the package files are present in the image
• UI client regenerated from an in-process OpenAPI dump (not port 7330). The diff is billing only.
• Real API/UI prod image builds with the new context: the local Docker disk is full, so CI's image build jobs cover this
• Stripe test-mode run of checkout and the async payment events: covered by unit tests with a fake Stripe HTTP layer only
• Pushed with --no-verify: the local pre-push e2e would run against another project's stack on :7331