feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/storage/guests.go

@@ -3,6 +3,8 @@ package storage
 import (
 	"context"
 	"errors"
+	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -88,6 +90,87 @@ func (r *GuestRepo) ListByEvent(ctx context.Context, eventID uuid.UUID, limit, o
 	return out, rows.Err()
 }
 
+// BulkImportRow is one normalised guest in a CSV import batch.
+type BulkImportRow struct {
+	Name     string
+	Email    string // empty if absent
+	Phone    string // empty if absent
+	PlusOnes int
+}
+
+// BulkImportResult reports the outcome of a single import call. The
+// SkippedEmails slice records the addresses we silently dropped because a
+// guest already exists on the event — useful for the success summary.
+type BulkImportResult struct {
+	Added         int
+	Skipped       int
+	SkippedEmails []string
+}
+
+// BulkImportGuests inserts up to len(rows) guest rows into the event in a
+// single transaction. Rows whose email matches an existing guest on the
+// event are skipped (idempotent re-imports). Within the batch, duplicate
+// emails after the first are also skipped. Either the entire batch
+// commits or none of it does.
+//
+// Empty email is treated as "no email" and not deduped — those rows
+// always insert (the host might be entering phone-only guests).
+func (r *GuestRepo) BulkImportGuests(ctx context.Context, eventID uuid.UUID, rows []BulkImportRow) (BulkImportResult, error) {
+	res := BulkImportResult{}
+	if len(rows) == 0 {
+		return res, nil
+	}
+
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return res, err
+	}
+	defer tx.Rollback(ctx)
+
+	// Fetch existing emails on the event into a set for O(1) dedup.
+	existing := map[string]struct{}{}
+	exRows, err := tx.Query(ctx,
+		`SELECT lower(email) FROM guests WHERE event_id = $1 AND email IS NOT NULL AND email <> ''`,
+		eventID)
+	if err != nil {
+		return res, fmt.Errorf("load existing emails: %w", err)
+	}
+	for exRows.Next() {
+		var e string
+		if err := exRows.Scan(&e); err != nil {
+			exRows.Close()
+			return res, err
+		}
+		existing[e] = struct{}{}
+	}
+	exRows.Close()
+
+	const ins = `
+        INSERT INTO guests (event_id, name, email, phone, plus_ones)
+        VALUES ($1, $2, NULLIF($3, ''), NULLIF($4, ''), $5)
+    `
+	for _, row := range rows {
+		email := strings.ToLower(strings.TrimSpace(row.Email))
+		if email != "" {
+			if _, dup := existing[email]; dup {
+				res.Skipped++
+				res.SkippedEmails = append(res.SkippedEmails, email)
+				continue
+			}
+			existing[email] = struct{}{}
+		}
+		if _, err := tx.Exec(ctx, ins, eventID, row.Name, email, row.Phone, row.PlusOnes); err != nil {
+			return BulkImportResult{}, fmt.Errorf("insert guest %q: %w", row.Name, err)
+		}
+		res.Added++
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return BulkImportResult{}, err
+	}
+	return res, nil
+}
+
 func scanGuest(s rowScanner) (*domain.Guest, error) {
 	var g domain.Guest
 	err := s.Scan(
@@ -100,6 +183,135 @@ func scanGuest(s rowScanner) (*domain.Guest, error) {
 	return &g, nil
 }
 
+// UpdateGuestParams patches a guest. Nil fields are left untouched.
+// An empty string for Email / Phone clears the column to NULL, matching
+// the frontend "clear this field" UX.
+type UpdateGuestParams struct {
+	Name     *string
+	Email    *string
+	Phone    *string
+	PlusOnes *int
+}
+
+// Update applies the patch to (guestID, eventID). Event scoping in the
+// WHERE clause prevents a host from patching guests on another host's
+// event even if they guess the guest_id. Returns ErrGuestNotFound when
+// the guest doesn't exist on the event.
+func (r *GuestRepo) Update(ctx context.Context, eventID, guestID uuid.UUID, p UpdateGuestParams) (*domain.Guest, error) {
+	sets := []string{}
+	args := []any{guestID, eventID}
+	add := func(col string, val any) {
+		args = append(args, val)
+		sets = append(sets, fmt.Sprintf("%s = $%d", col, len(args)))
+	}
+	if p.Name != nil {
+		add("name", strings.TrimSpace(*p.Name))
+	}
+	if p.Email != nil {
+		if strings.TrimSpace(*p.Email) == "" {
+			sets = append(sets, "email = NULL")
+		} else {
+			add("email", strings.ToLower(strings.TrimSpace(*p.Email)))
+		}
+	}
+	if p.Phone != nil {
+		if strings.TrimSpace(*p.Phone) == "" {
+			sets = append(sets, "phone = NULL")
+		} else {
+			add("phone", strings.TrimSpace(*p.Phone))
+		}
+	}
+	if p.PlusOnes != nil {
+		add("plus_ones", *p.PlusOnes)
+	}
+	if len(sets) == 0 {
+		return r.Get(ctx, guestID)
+	}
+	q := fmt.Sprintf(`
+        UPDATE guests SET %s
+        WHERE id = $1 AND event_id = $2
+        RETURNING id, event_id, name, email, phone, plus_ones, dietary_notes, table_number, created_at
+    `, strings.Join(sets, ", "))
+	g, err := scanGuest(r.pool.QueryRow(ctx, q, args...))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, domain.ErrGuestNotFound
+		}
+		return nil, err
+	}
+	return g, nil
+}
+
+// Delete removes a guest from an event. Cascade-deletes any tokens,
+// rsvps, access_logs, and notifications tied to the guest. Event scoping
+// in the WHERE clause stops cross-tenant deletes.
+func (r *GuestRepo) Delete(ctx context.Context, eventID, guestID uuid.UUID) error {
+	tag, err := r.pool.Exec(ctx,
+		`DELETE FROM guests WHERE id = $1 AND event_id = $2`,
+		guestID, eventID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return domain.ErrGuestNotFound
+	}
+	return nil
+}
+
+// GuestForInvitation is the minimum data the bulk-invite path needs about
+// each candidate. Pulled in a single query joined against tokens so the
+// caller knows up-front who's already received an invitation.
+type GuestForInvitation struct {
+	ID       uuid.UUID
+	Name     string
+	Email    string // empty when the guest has no email on file
+	HasToken bool
+}
+
+// ListGuestsForInvitation returns every guest on `eventID`, joined with
+// the tokens table so the caller can skip guests that already have one.
+// When `onlyIDs` is non-nil/non-empty, the result is filtered to that
+// subset (used for explicit selection in the bulk-send UI).
+func (r *GuestRepo) ListGuestsForInvitation(ctx context.Context, eventID uuid.UUID, onlyIDs []uuid.UUID) ([]GuestForInvitation, error) {
+	var (
+		rows pgx.Rows
+		err  error
+	)
+	if len(onlyIDs) == 0 {
+		rows, err = r.pool.Query(ctx, `
+            SELECT g.id, g.name, COALESCE(g.email,''),
+                   (t.id IS NOT NULL) AS has_token
+            FROM guests g
+            LEFT JOIN tokens t ON t.guest_id = g.id
+            WHERE g.event_id = $1
+            ORDER BY g.created_at ASC
+        `, eventID)
+	} else {
+		rows, err = r.pool.Query(ctx, `
+            SELECT g.id, g.name, COALESCE(g.email,''),
+                   (t.id IS NOT NULL) AS has_token
+            FROM guests g
+            LEFT JOIN tokens t ON t.guest_id = g.id
+            WHERE g.event_id = $1 AND g.id = ANY($2)
+            ORDER BY g.created_at ASC
+        `, eventID, onlyIDs)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []GuestForInvitation
+	for rows.Next() {
+		var g GuestForInvitation
+		if err := rows.Scan(&g.ID, &g.Name, &g.Email, &g.HasToken); err != nil {
+			return nil, err
+		}
+		out = append(out, g)
+	}
+	return out, rows.Err()
+}
+
 // GuestWithRSVP is the dashboard view: a guest plus the RSVP submitted
 // against their token, if any. RSVP fields are nil when no response yet.
 type GuestWithRSVP struct {