Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/src/lib/secret-scan.ts

@@ -0,0 +1,31 @@
+/**
+ * L-05: reject agent content that looks like a leaked credential before it
+ * is stored or published. `scanForSecrets` returns matched PATTERN NAMES
+ * only — never the matched values (those must not be echoed anywhere).
+ */
+
+const PATTERNS: readonly (readonly [string, RegExp])[] = [
+  ['aws_access_key', /AKIA[0-9A-Z]{16}/],
+  ['pem_private_key', /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+  ['openai_api_key', /sk-[A-Za-z0-9]{20,}/],
+  ['github_token', /ghp_[A-Za-z0-9]{36}/],
+  ['generic_credential', /(?:password|passwd|api[_-]?key|secret)\s*[:=]\s*\S+/i],
+] as const
+
+export function scanForSecrets(text: string): string[] {
+  const names: string[] = []
+  for (const [name, re] of PATTERNS) {
+    if (re.test(text)) names.push(name)
+  }
+  return names
+}
+
+/** Scan the strings an agent can set; returns pattern names across all targets. */
+export function scanAgentPayload(targets: (string | undefined | null)[]): string[] {
+  const names = new Set<string>()
+  for (const target of targets) {
+    if (typeof target !== 'string') continue
+    for (const name of scanForSecrets(target)) names.add(name)
+  }
+  return [...names]
+}