feat: WS5 — service bundles (config builder → widget packages → Overview) (#138)

feat(config): WS4 — map-drawn service area (Leaflet + OSM) (#137)

feat(config): WS2 — services builder v2 (auto-ID, requires dropdown, pricing units) (#135)

feat(app): warn when email.from is off an authenticated sending domain (#108)

feat(app): W5 — in-widget checkout + operator-configurable qualifying questions (#105)

feat(app): P2a foundation — tenant-config validation (the 2b security boundary)