Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/src/collections/Users.ts

@@ -1,6 +1,7 @@
-import { pbkdf2 } from 'crypto'
+import { pbkdf2, randomBytes } from 'crypto'
 import { promisify } from 'util'
 import type { AccessArgs, CollectionConfig } from 'payload'
+import { sendVerificationEmail } from '@/lib/mail'
 
 const isAdmin = (args: AccessArgs) =>
   (args.req.user as { role?: string } | null | undefined)?.role === 'admin'
@@ -88,6 +89,31 @@ const Users: CollectionConfig = {
         return data
       },
     ],
+    // L-06 signup trust: the verify-email page claims «أرسلنا رابط التأكيد» —
+    // make that true at signup instead of only after clicking resend. Mirror
+    // api/auth/resend-verification exactly: fresh token → internal update
+    // (systemActivation bypasses the beforeChange token strip) → email.
+    // Mail env absent → sendVerificationEmail returns { sent: false } and the
+    // hook skips silently; the resend route keeps the honest-503 path.
+    afterChange: [
+      async ({ doc, operation, req }) => {
+        if (operation !== 'create' || !doc?.email) return
+        try {
+          const token = randomBytes(32).toString('hex')
+          await req.payload.update({
+            collection: 'users',
+            id: doc.id,
+            data: { verificationToken: token },
+            overrideAccess: true,
+            context: { systemActivation: true },
+            req,
+          })
+          await sendVerificationEmail(doc.email, token)
+        } catch (err) {
+          console.error('signup verification email failed:', err)
+        }
+      },
+    ],
   },
   fields: [
     {