fix: use private helcimApiToken for all server-side Helcim API calls

CLAUDE.md

@@ -71,7 +71,10 @@ Copy `.env.example` to `.env`. Required: `MONGODB_URI`, `JWT_SECRET`, `RESEND_AP
 - Use `USwitch` (not `UToggle`) — this is the correct Nuxt UI 3+ component name
 - No fallback/placeholder data — always use real data
 - Follow Nuxt 4 file-based routing conventions for route naming
-- Always check Nuxt UI 3 latest documentation on the web when implementing UI components
+- Always check Nuxt UI 4 latest documentation on the web when implementing UI components
+- Auth API responses (`/api/auth/status`, `/api/auth/member`) must include `status` in the returned member object — `useMemberStatus` defaults to `PENDING_PAYMENT` if missing
+- Helcim payment testing requires ngrok: `npx nuxi dev --https` then `ngrok http https://localhost:3000` — Helcim blocks localhost origins
+- The `/api/helcim/initialize-payment` endpoint skips auth for `event_ticket` type payments (public users can buy tickets)
 
 ## Product Spec
 
@@ -90,8 +93,3 @@ The sections below describe planned and in-progress features for reference.
 ### Resources (Planned)
 - Learning paths by circle, templates and tools, case studies
 - Tag by circle relevance, download tracking, version control
-
-### Implementation Priority
-**Must have:** Payment processing, Slack automation, member dashboard, resource library, event listing/RSVP
-**Nice to have:** Member profiles, peer matching, Cal.com, member updates
-**Post-launch:** Etherpad integration, member-proposed events, advanced search, analytics dashboard