Jennie Robinson Faber 51230e5151 refactor(launch): simplify launch-readiness fixes ... Follow-up to 208638e. Code review surfaced a few real issues; this commit addresses them. - login.post.js now uses the new sendMagicLink util instead of duplicating the jti/jwt/Resend/logActivity logic. Reduces 60 lines. - sendMagicLink accepts an optional pre-loaded Member doc, skipping the redundant findOne when the caller already has one. customer.post.js passes the just-created/upgraded member, dropping signup from 3 Mongo round-trips to 1 (lookup is gone; jti burn remains). - sendMagicLink now lowercases the email defensively so callers don't have to remember. - rateLimit.js: replaced an effectively-dead eviction line with a probabilistic sweep (~1% of calls scan and evict keys whose newest entry has aged out). Caps unbounded Map growth under random-key spraying. - reconcile-payments.post.js: 401/403/404 from Helcim now bails out immediately instead of burning all 3 retry attempts; dry-run summary filters via the same RECONCILABLE_STATUSES set as apply mode so counts match. - Deleted WHAT-comments and section banners per CLAUDE.md no-comment rule. Kept genuine WHY-comments (validateBeforeSave rationale, amount-IGNORED-for-tickets, sendConfirmation deliberately-omitted). Tests: 758/760 passing (unchanged).		2026-04-25 19:34:16 +01:00
..
login.post.js	refactor(launch): simplify launch-readiness fixes	2026-04-25 19:34:16 +01:00
logout.post.js	fix: remove redundant connectDB in logout (requireAuth handles it)	2026-04-04 12:24:24 +01:00
member.get.js	merge: catch up with feature/helcim-plan-consolidation base	2026-04-19 21:33:40 +01:00
refresh.post.js	fix: use private helcimApiToken for all server-side Helcim API calls	2026-04-04 13:37:34 +01:00
status.get.js	feat(server): rename contributionTier → contributionAmount in routes + utils	2026-04-19 18:44:29 +01:00
verify.post.js	feat(launch): security and correctness fixes for 2026-05-01 launch	2026-04-25 18:42:36 +01:00