Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/docker-compose.vps.yml

@@ -30,17 +30,29 @@ services:
       PAYLOAD_SECRET: ${PAYLOAD_SECRET}
       AGENT_API_KEY: ${AGENT_API_KEY}
       NEXT_PUBLIC_SITE_URL: https://anwarpy.ai
+      LAUNCH_MODE: ${LAUNCH_MODE:-free_early_access}
       CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
       CLOUDFLARE_ACCOUNT_ID: ${CLOUDFLARE_ACCOUNT_ID}
       MAIL_FROM: noreply@anwarpy.ai
     labels:
       - traefik.enable=true
-      - traefik.http.routers.anwarpi.rule=Host(`anwarpy.ai`) || Host(`www.anwarpy.ai`)
+      - traefik.http.routers.anwarpi.rule=Host(`anwarpy.ai`)
       - traefik.http.routers.anwarpi.entrypoints=websecure
       - traefik.http.routers.anwarpi.tls.certresolver=mytlschallenge
       - traefik.http.routers.anwarpi.middlewares=pagelimit@docker,connlimit@docker
       - traefik.http.services.anwarpi.loadbalancer.server.port=3000
-      - traefik.http.routers.anwarpi-api.rule=PathPrefix(`/api`) && (Host(`anwarpy.ai`) || Host(`www.anwarpy.ai`))
+      # 39: canonical host is the apex. www hits this router first (priority
+      # above anwarpi-api's 100) and is 301-redirected before any rate limit.
+      - traefik.http.routers.anwarpi-www.rule=Host(`www.anwarpy.ai`)
+      - traefik.http.routers.anwarpi-www.entrypoints=websecure
+      - traefik.http.routers.anwarpi-www.tls.certresolver=mytlschallenge
+      - traefik.http.routers.anwarpi-www.priority=110
+      - traefik.http.routers.anwarpi-www.service=anwarpi
+      - traefik.http.routers.anwarpi-www.middlewares=www-redirect
+      - traefik.http.middlewares.www-redirect.redirectregex.regex=^https://www\.anwarpy\.ai/(.*)
+      - traefik.http.middlewares.www-redirect.redirectregex.replacement=https://anwarpy.ai/$$1
+      - traefik.http.middlewares.www-redirect.redirectregex.permanent=true
+      - traefik.http.routers.anwarpi-api.rule=PathPrefix(`/api`) && Host(`anwarpy.ai`)
       - traefik.http.routers.anwarpi-api.entrypoints=websecure
       - traefik.http.routers.anwarpi-api.tls=true
       - traefik.http.routers.anwarpi-api.tls.certresolver=mytlschallenge