Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/src/app/(frontend)/login/page.tsx

@@ -41,6 +41,23 @@ export default function LoginPage() {
       router.push(safeNext(new URLSearchParams(window.location.search).get('next')) ?? '/account-settings')
         return
       }
+      const err = await res.json().catch(() => null) as { error?: string; errors?: { message?: string }[] } | null
+      // Rate-limit / middleware shape first: { error: string } + optional Retry-After.
+      if (typeof err?.error === 'string') {
+        const retryAfterSec = Number(res.headers.get('Retry-After'))
+        setStatus(
+          res.headers.get('Retry-After') && Number.isFinite(retryAfterSec)
+            ? `${err.error} حاول بعد ${Math.max(1, Math.ceil(retryAfterSec / 60))} دقيقة.`
+            : err.error,
+        )
+        return
+      }
+      const message = err?.errors?.[0]?.message
+      if (message && /locked/i.test(message)) {
+        // Payload lockout: maxLoginAttempts 5 / lockTime 15min (Users.ts).
+        setStatus('تم تجاوز عدد المحاولات المسموح. حاول بعد ١٥ دقيقة.')
+        return
+      }
       setStatus('تعذّر تسجيل الدخول — تحقّق من البريد وكلمة المرور.')
     } catch {
       setStatus('تعذّر الاتصال. حاول تسجيل الدخول مرة أخرى.')