feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/storage/subscriptions.go

@@ -0,0 +1,223 @@
+package storage
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Subscription mirrors the subscriptions table row. Stored as a thin
+// projection of the Stripe state — we don't try to mirror every field,
+// just what middleware + handlers need to decide access.
+type Subscription struct {
+	ID                   uuid.UUID
+	UserID               uuid.UUID
+	StripeCustomerID     string
+	StripeSubscriptionID *string
+	Tier                 string
+	Status               string
+	CurrentPeriodEnd     *time.Time
+	CancelAtPeriodEnd    bool
+	CreatedAt            time.Time
+	UpdatedAt            time.Time
+}
+
+// ErrSubscriptionNotFound is returned when no row matches the lookup.
+var ErrSubscriptionNotFound = errors.New("subscription not found")
+
+type SubscriptionRepo struct {
+	pool *pgxpool.Pool
+}
+
+func NewSubscriptionRepo(db *DB) *SubscriptionRepo {
+	return &SubscriptionRepo{pool: db.Pool}
+}
+
+const subscriptionColumns = `
+    id, user_id, stripe_customer_id, stripe_subscription_id,
+    tier, status, current_period_end, cancel_at_period_end,
+    created_at, updated_at
+`
+
+// GetActiveByUser returns the user's currently-granting subscription
+// (active / trialing / past_due). Returns ErrSubscriptionNotFound when
+// the user has no row at all — caller treats that as free tier.
+func (r *SubscriptionRepo) GetActiveByUser(ctx context.Context, userID uuid.UUID) (*Subscription, error) {
+	const q = `
+        SELECT ` + subscriptionColumns + `
+        FROM subscriptions
+        WHERE user_id = $1
+          AND status IN ('active','past_due','trialing')
+        ORDER BY updated_at DESC
+        LIMIT 1
+    `
+	return r.scanOne(ctx, q, userID)
+}
+
+// GetByCustomer fetches by Stripe customer id — webhooks use this since
+// the event payload identifies the customer, not the user.
+func (r *SubscriptionRepo) GetByCustomer(ctx context.Context, customerID string) (*Subscription, error) {
+	const q = `
+        SELECT ` + subscriptionColumns + `
+        FROM subscriptions WHERE stripe_customer_id = $1
+        ORDER BY updated_at DESC LIMIT 1
+    `
+	return r.scanOne(ctx, q, customerID)
+}
+
+// FindCustomerID returns the Stripe customer id we've already created
+// for this user, or "" if none exists yet. Avoids creating duplicate
+// Stripe customers across checkout sessions.
+func (r *SubscriptionRepo) FindCustomerID(ctx context.Context, userID uuid.UUID) (string, error) {
+	const q = `
+        SELECT stripe_customer_id FROM subscriptions
+        WHERE user_id = $1 ORDER BY created_at ASC LIMIT 1
+    `
+	var id string
+	if err := r.pool.QueryRow(ctx, q, userID).Scan(&id); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "", nil
+		}
+		return "", err
+	}
+	return id, nil
+}
+
+// UpsertParams collects everything an upsert needs. Pointer types denote
+// "skip writing this column" (used when a webhook only carries partial
+// data — we never want to clobber tier or period info we don't have).
+type UpsertParams struct {
+	UserID               uuid.UUID
+	StripeCustomerID     string
+	StripeSubscriptionID *string
+	Tier                 *string
+	Status               *string
+	CurrentPeriodEnd     *time.Time
+	CancelAtPeriodEnd    *bool
+}
+
+// Upsert inserts a new row or updates an existing one keyed by
+// stripe_customer_id. Used by both the checkout-success handler and the
+// webhook subscription-lifecycle handler.
+func (r *SubscriptionRepo) Upsert(ctx context.Context, p UpsertParams) (*Subscription, error) {
+	const q = `
+        INSERT INTO subscriptions (
+            user_id, stripe_customer_id, stripe_subscription_id,
+            tier, status, current_period_end, cancel_at_period_end
+        )
+        VALUES (
+            $1, $2, $3,
+            COALESCE($4, 'free'), COALESCE($5, 'incomplete'),
+            $6, COALESCE($7, FALSE)
+        )
+        ON CONFLICT (id) DO NOTHING
+        RETURNING ` + subscriptionColumns + `
+    `
+
+	row := r.pool.QueryRow(ctx, q,
+		p.UserID, p.StripeCustomerID, p.StripeSubscriptionID,
+		p.Tier, p.Status, p.CurrentPeriodEnd, p.CancelAtPeriodEnd,
+	)
+	sub, err := scanSubscription(row)
+	if err == nil {
+		return sub, nil
+	}
+	if !errors.Is(err, pgx.ErrNoRows) {
+		return nil, err
+	}
+
+	// Race or duplicate insert — fall back to an explicit update on the
+	// stripe_customer_id (the FK to Stripe's source of truth).
+	const upd = `
+        UPDATE subscriptions SET
+            stripe_subscription_id = COALESCE($3, stripe_subscription_id),
+            tier                   = COALESCE($4, tier),
+            status                 = COALESCE($5, status),
+            current_period_end     = COALESCE($6, current_period_end),
+            cancel_at_period_end   = COALESCE($7, cancel_at_period_end),
+            updated_at             = now()
+        WHERE user_id = $1 AND stripe_customer_id = $2
+        RETURNING ` + subscriptionColumns + `
+    `
+	row = r.pool.QueryRow(ctx, upd,
+		p.UserID, p.StripeCustomerID, p.StripeSubscriptionID,
+		p.Tier, p.Status, p.CurrentPeriodEnd, p.CancelAtPeriodEnd,
+	)
+	return scanSubscription(row)
+}
+
+// UpdateByCustomer patches the subscription row keyed by Stripe customer
+// id. Used by webhooks where we have the customer reference but not
+// always the user id.
+func (r *SubscriptionRepo) UpdateByCustomer(ctx context.Context, customerID string, p UpsertParams) error {
+	const q = `
+        UPDATE subscriptions SET
+            stripe_subscription_id = COALESCE($2, stripe_subscription_id),
+            tier                   = COALESCE($3, tier),
+            status                 = COALESCE($4, status),
+            current_period_end     = COALESCE($5, current_period_end),
+            cancel_at_period_end   = COALESCE($6, cancel_at_period_end),
+            updated_at             = now()
+        WHERE stripe_customer_id = $1
+    `
+	_, err := r.pool.Exec(ctx, q,
+		customerID, p.StripeSubscriptionID,
+		p.Tier, p.Status, p.CurrentPeriodEnd, p.CancelAtPeriodEnd,
+	)
+	return err
+}
+
+// CountEventsInCurrentMonth returns how many events the user has created
+// since the 1st of the current UTC month. Used for free-tier "1 event /
+// month" and Pro-tier "10 events / month" enforcement.
+func (r *SubscriptionRepo) CountEventsInCurrentMonth(ctx context.Context, userID uuid.UUID) (int, error) {
+	const q = `
+        SELECT count(*) FROM events
+        WHERE host_id = $1
+          AND created_at >= date_trunc('month', now() AT TIME ZONE 'UTC')
+    `
+	var n int
+	if err := r.pool.QueryRow(ctx, q, userID).Scan(&n); err != nil {
+		return 0, err
+	}
+	return n, nil
+}
+
+// CountGuestsByEvent returns the current guest count for an event. Used
+// for per-event guest cap enforcement.
+func (r *SubscriptionRepo) CountGuestsByEvent(ctx context.Context, eventID uuid.UUID) (int, error) {
+	var n int
+	if err := r.pool.QueryRow(ctx,
+		`SELECT count(*) FROM guests WHERE event_id = $1`, eventID,
+	).Scan(&n); err != nil {
+		return 0, err
+	}
+	return n, nil
+}
+
+func (r *SubscriptionRepo) scanOne(ctx context.Context, q string, args ...any) (*Subscription, error) {
+	sub, err := scanSubscription(r.pool.QueryRow(ctx, q, args...))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrSubscriptionNotFound
+		}
+		return nil, err
+	}
+	return sub, nil
+}
+
+func scanSubscription(s rowScanner) (*Subscription, error) {
+	var sub Subscription
+	if err := s.Scan(
+		&sub.ID, &sub.UserID, &sub.StripeCustomerID, &sub.StripeSubscriptionID,
+		&sub.Tier, &sub.Status, &sub.CurrentPeriodEnd, &sub.CancelAtPeriodEnd,
+		&sub.CreatedAt, &sub.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &sub, nil
+}