Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/src/lib/mail.ts

@@ -1,3 +1,42 @@
+/* Generic text-only send over the same Cloudflare Email Sending REST call —
+   used by /api/notify for the launch-notification confirmation. Single-shot,
+   honest { sent: false } on any failure; no retry. */
+export async function sendMail(to: string, subject: string, text: string): Promise<{ sent: boolean }> {
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN
+  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID
+  if (!apiToken || !accountId) return { sent: false }
+
+  try {
+    const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/email/sending/send`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        to,
+        from: { address: process.env.MAIL_FROM ?? 'noreply@anwarpy.ai', name: 'أنور بي آي' },
+        subject,
+        text,
+      }),
+    })
+
+    if (!res.ok) {
+      console.error('cloudflare email sending failed:', res.status, await res.text())
+      return { sent: false }
+    }
+    const json = (await res.json()) as { success?: boolean }
+    if (!json.success) {
+      console.error('cloudflare email sending rejected:', JSON.stringify(json))
+      return { sent: false }
+    }
+    return { sent: true }
+  } catch (err) {
+    console.error('cloudflare email sending threw:', err)
+    return { sent: false }
+  }
+}
+
 /* Cloudflare Email Sending (REST) — activates only when CLOUDFLARE_API_TOKEN
    and CLOUDFLARE_ACCOUNT_ID are set. Without them, sendVerificationEmail
    returns { sent: false } and the UI degrades to a clear status message; the