Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/scripts/backfill-reading-minutes.ts

@@ -0,0 +1,40 @@
+/**
+ * Backfill `readingMinutes` on every post from its body (L-07).
+ * No schema change — safe to re-run any time.
+ *
+ * Usage: cd web && npx tsx scripts/backfill-reading-minutes.ts
+ */
+import { getPayload } from 'payload'
+import configPromise from '@payload-config'
+import { countLexicalWords } from '../src/lib/lexical'
+import { READING_WORDS_PER_MINUTE } from '../src/lib/launch'
+
+const payload = await getPayload({ config: configPromise })
+
+const { docs } = await payload.find({
+  collection: 'posts',
+  limit: 500,
+  depth: 0,
+  overrideAccess: true,
+})
+
+let updated = 0
+for (const post of docs) {
+  const words = countLexicalWords(post.content)
+  const readingMinutes = Math.max(1, Math.round(words / READING_WORDS_PER_MINUTE))
+  if (readingMinutes !== post.readingMinutes) {
+    await payload.update({
+      collection: 'posts',
+      id: post.id,
+      data: { readingMinutes },
+      overrideAccess: true,
+      context: { systemBackfill: true },
+    })
+    payload.logger.info(`backfill: ${post.slug} ${post.readingMinutes} → ${readingMinutes} (${words} words)`)
+    updated += 1
+  }
+}
+
+payload.logger.info(`backfill complete: ${docs.length} scanned, ${updated} updated`)
+// Postgres pool keeps the loop alive — release it so the script exits.
+await payload.db.destroy?.()

web/scripts/backup-db.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# anwarpy.ai — Postgres backup (L-06)
+#
+# Run ON THE VPS (needs the `proxy`/compose network up):
+#   ./scripts/backup-db.sh
+#
+# Cron (nightly 03:15, keep dir writable):
+#   15 3 * * * cd /root/anwarpi && ./scripts/backup-db.sh >> backups/backup.log 2>&1
+#
+# Restore a dump into the running db container:
+#   gunzip -c backups/anwarpi-YYYYMMDD-HHMMSS.sql.gz | \
+#     docker compose -f docker-compose.vps.yml exec -T db psql -U anwarpi anwarpi
+#
+# Restore-rehearsal (verify a backup is loadable BEFORE you need it):
+#   gunzip -c backups/<file>.sql.gz | \
+#     docker compose -f docker-compose.vps.yml exec -T db psql -U anwarpi -c "CREATE DATABASE anwarpi_restore_test;"
+#   gunzip -c backups/<file>.sql.gz | \
+#     docker compose -f docker-compose.vps.yml exec -T db psql -U anwarpi -d anwarpi_restore_test -q
+#   docker compose -f docker-compose.vps.yml exec -T db psql -U anwarpi -d anwarpi_restore_test -tAc \
+#     "SELECT (SELECT count(*) FROM posts) AS posts, (SELECT count(*) FROM users) AS users;"
+#   docker compose -f docker-compose.vps.yml exec -T db psql -U anwarpi -c "DROP DATABASE anwarpi_restore_test;"
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+mkdir -p backups
+STAMP=$(date +%Y%m%d-%H%M%S)
+OUT="backups/anwarpi-${STAMP}.sql.gz"
+
+docker compose -f docker-compose.vps.yml exec -T db pg_dump -U anwarpi anwarpi | gzip > "$OUT"
+echo "wrote $OUT ($(du -h "$OUT" | cut -f1))"