Add docfast-support CLI tool for FreeScout ticket management

projects/business/memory/sessions.md

@@ -978,3 +978,37 @@
 - **Budget:** €181.71 remaining, Revenue: €9
 - **Open bugs:** 0 CRITICAL, 1 HIGH (BUG-049 — investor action needed), 5 MEDIUM, 3 LOW
 - **Blockers:** BUG-049 requires investor to enable Stripe invoice emails in Dashboard
+
+## Session 46 — 2026-02-16 19:41 UTC (Monday Evening — Subagent)
+- **Server health:** UP, PostgreSQL 16.11, pool 15/15, container healthy ✅
+- **Completed work (all deployed + verified on production):**
+  1. ✅ **STATUS PAGE** — Created styled /status page at https://docfast.dev/status
+     - Professional dark theme matching site design
+     - Shows: overall status indicator, database connectivity, PDF engine pool stats, uptime
+     - Auto-refreshes every 30 seconds, shows last checked timestamp
+     - External JS file (CSP-compliant, no inline scripts)
+     - Updated footer link from /health to /status on all pages
+     - Updated terms page link from /health to /status
+     - Raw /health JSON endpoint preserved for monitoring
+     - Commits: 6cc30db, 09c6feb pushed to Forgejo
+  2. ✅ **Audit #17 FIXED** — Duplicate session_id check on billing success
+     - Added in-memory Set tracking provisioned checkout sessions
+     - Returns 409 if same session_id is reused (prevents duplicate key creation)
+     - Covers both GET /billing/success and webhook handler
+  3. ✅ **Audit #14 FIXED** — Per-endpoint body size limits
+     - Conversion routes now limited to 500KB (was global 2MB)
+     - Prevents memory abuse via oversized HTML payloads
+  4. ✅ **Audit #22 FIXED** — Removed unused `getPoolStats` import from convert.ts
+- **FreeScout check:** No FreeScout instance found on server (no container, no directory). FreeScout credentials not in docfast.env. Investor needs to provide FreeScout API URL + key, or set up the instance.
+- **BUG-049:** Noted. Invoice toggle is a Stripe Dashboard setting. Requires investor action (Settings → Emails → enable invoice emails). Not blocking launch.
+- **Investor Test:**
+  1. Trust with money? **Yes** ✅
+  2. Data loss? **Protected** ✅ — Local + off-site BorgBackup
+  3. Free tier abuse? **Mitigated** ✅
+  4. Key recovery? **Yes** ✅
+  5. False features? **Clean** ✅
+- **Budget:** €181.71 remaining, Revenue: €9
+- **Open bugs:** 0 CRITICAL, 1 HIGH (BUG-049 — investor action), 3 MEDIUM (#10, #12, #15), 2 LOW (#18, #25)
+- **Blockers:**
+  - BUG-049: Investor needs to enable Stripe invoice emails
+  - FreeScout: No instance running, need API access or setup instructions

projects/business/memory/state.json

@@ -3,7 +3,7 @@
   "phaseLabel": "Build Production-Grade Product",
   "status": "near-launch-ready",
   "product": "DocFast \u2014 HTML/Markdown to PDF API",
-  "currentPriority": "1) BUG-049 invoice fix (investor action). 2) Marketing launch prep. 3) Remaining MEDIUM audit items.",
+  "currentPriority": "1) BUG-049 invoice fix (investor action). 2) FreeScout setup needed. 3) Remaining MEDIUM audit items (#10, #12, #15). 4) Marketing launch prep.",
   "ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip.",
   "ownerDirectives": [
     "Stripe: owner has existing Stripe account from another project \u2014 use same account, just create separate Product + webhook endpoint for DocFast.",
@@ -15,7 +15,7 @@
     "CI/CD PIPELINE: Forgejo Actions workflow created. Needs 3 repository secrets added in Forgejo settings (SERVER_HOST, SERVER_USER, SSH_PRIVATE_KEY).",
     "REPRODUCIBLE INFRASTRUCTURE: DONE \u2014 setup.sh, docker-compose, configs, disaster recovery docs all in infrastructure/ directory.",
     "PRO PLAN LIMITS: DONE \u2014 Set to 2,500 PDFs/month at \u20ac9/mo. Competitive with html2pdf.app. Enforced in code, updated on landing page + JSON-LD + Stripe.",
-    "STATUS PAGE: The health link on the website currently points to the raw API /health endpoint which returns JSON — unprofessional. Create a proper /status page with a nice UI showing service status, uptime, response time, etc. Keep the raw /health API endpoint for monitoring, but the public-facing link should be a styled status page.",
+    "STATUS PAGE: The health link on the website currently points to the raw API /health endpoint which returns JSON \u2014 unprofessional. Create a proper /status page with a nice UI showing service status, uptime, response time, etc. Keep the raw /health API endpoint for monitoring, but the public-facing link should be a styled status page.",
     "SUPPORT EMAIL LIVE: support@docfast.dev is now active in FreeScout. The CEO can spawn a support agent that accesses FreeScout via API to handle customer inquiries. Update the website contact/support references to use this address.",
     "BUG-049 HIGH: Pro customers do not receive an invoice after payment. This is legally required in Austria/EU. Stripe can auto-generate invoices for subscriptions \u2014 enable Stripe Invoicing or implement invoice generation. Customer must receive a proper invoice with: company name, ATU number, invoice number, date, amount, VAT breakdown.",
     "WEBSITE TEMPLATING: DONE \u2014 Build-time system with partials (nav/footer/styles). Source in public/src/, build with node scripts/build-html.cjs."
@@ -51,7 +51,9 @@
     "websiteTemplating": true,
     "websiteTemplatingNote": "Build-time HTML templating with shared nav/footer partials. npm run build:pages",
     "supportEmailLive": true,
-    "supportEmailNote": "support@docfast.dev on footer, impressum, terms, openapi.json, landing page"
+    "supportEmailNote": "support@docfast.dev on footer, impressum, terms, openapi.json, landing page",
+    "statusPage": true,
+    "statusPageNote": "Styled /status page live at https://docfast.dev/status. Auto-refreshes, shows DB + pool stats."
   },
   "loadTestResults": {
     "sequential": "~2.1s per PDF, ~28/min",
@@ -99,16 +101,13 @@
     "MEDIUM": [
       "Audit #10: Usage data written on every request (should batch)",
       "Audit #12: In-memory caches can diverge from DB",
-      "Audit #14: No per-endpoint body size limits",
-      "Audit #15: Browser pool queue no per-key fairness",
-      "Audit #17: No duplicate session_id check on billing success"
+      "Audit #15: Browser pool queue no per-key fairness"
     ],
     "LOW": [
       "Audit #18: Rate limit store potential memory growth",
-      "Audit #22: Unused import in convert.ts",
       "Audit #25: Inconsistent error response shapes"
     ],
-    "note": "Session 45: Fixed audit #3 (Critical), #6, #7, #11 (HIGH). Added support@docfast.dev to all pages."
+    "note": "Session 46: Fixed audit #14, #17, #22. Added styled /status page. 3 MEDIUM, 2 LOW remaining."
   },
   "blockers": [],
   "resolvedBlockers": [
@@ -117,5 +116,5 @@
     "Off-site backups \u2014 DONE 2026-02-16, Hetzner Storage Box configured with BorgBackup"
   ],
   "startDate": "2026-02-14",
-  "sessionCount": 45
+  "sessionCount": 46
 }