Redesign Upload Book section with modern UI

feat: full cover+genre extraction from all platforms - platform HTML parsers + DB fields

feat: rich shimmer skeleton loading animation for books table

fix: 3 bugs — stalled false positive, unknown platform crash, genre/processing UI

fix: SyntaxError in books.py — close preview return dict before import-url decorator

feat: URL import now auto-indexes scraped metadata instantly — no file upload needed

fix: indexing-stalled false positive, genre not saved, book table UI

feat: replace Upload Book UI with full URL-import-first flow in real admin SPA

feat: deep book metadata extraction - author bio, genre, ratings, pages

feat: book URL import - 10 platforms, 3-step UI, scraper service

feat: show IP address in sessions + persistent login until logout - Add ip_address field to ChatSession model (VARCHAR 45, handles IPv4+IPv6) - Store real client IP at session/init time via get_real_ip() - Expose ip_address in /sessions list and /sessions/{id}/transcript responses - DB migration: ip_address column added to chat_sessions - Bump REFRESH_TOKEN_EXPIRE_DAYS from 7 to 30 days (stay logged in 1 month) - Fix auth-client.js: refreshAccessToken only clears session on 401/403, not on network/5xx errors (HF cold-start safe) - Fix restoreSession: keeps session alive when refresh fails transiently, only clears on explicit auth rejection

feat: proper visitor analytics system - New Visitor model (visitor_uid + fingerprint fallback, first_seen/last_seen/page_views, geo, device) - VisitorRepository with upsert + analytics queries - visitor_tracker.py: record_visitor() upserts on every session/init - session/init accepts visitor_uid in request body (HF-Spaces iframe-safe, no cookies) - 4 new analytics endpoints: /visitors /geo /devices /sessions/stats - geo.py: region extraction + X-Real-IP support - DB migration: visitor_uid column on chat_sessions - ARCHITECTURE.md updated

fix: 5 critical storage bugs + 3 SQLite/SSE bugs -- tracker.py: db.flush() after add() so chat messages/analytics are persisted -- chat.py: flush->commit for durable ChatSession row -- settings.py: fix session mismatch in all PUT routes (widget-config, profile, personality, notifications, password) - setattr on cross-session user was discarded; now uses UPDATE stmt on route db -- aggregator.py: replace PostgreSQL-only gen_random_uuid() with uuid4() param for SQLite -- ingest.py: fix SSE channel name mismatch subscriber vs publisher -- superadmin_service.py: fix naive/aware datetime TypeError in extend_subscription

fix: Audit pass — critical bug fix + lazy import cleanup (qa/books/schemas_router)

feat: Phase 10 — Analytics endpoints (unanswered/books/heatmap)

refactor: Phase 6A+6B — top-level imports and Pydantic schema upgrades

feat: Phases 2B + 3B — semantic Q&A and vector store fixes

Refactor: 10/10 modularity — pipeline/ package, admin/routers/ split, guards single source of truth

Fix: book readiness check uses chunk_count+chroma_id as real truth; add stuck-book detection + Re-upload button in admin

Fix: datetime naive/aware crash across embed-token, access-repo, superadmin, expiry-task + friendly no-subscription UI

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Enforce strict SuperAdmin vs Author panel separation.

Fix token display for unsubscribed authors and add SuperAdmin author removal.

Unify token tracking, smart links, and personality settings across admin and chat.

Fix logout on page refresh by restoring sessions via refresh token and cookies.

Humanize bot responses for greetings, catalog questions, and empty RAG retrieval.

Fix auth session expiry with shared auto-refresh client for admin panels.

Fix chat session init crash and improve embed reliability

fix: naive vs aware datetime error in grants/extend/embed-token, grant button loading state + 15s timeout + token display modal

feat: Per-user auto embed token, full Token Management SA page, fix extend on expired subs, add /grants + /reset-tokens + /embed-token endpoints

Fix CSS: sidebar now scrollable with thin scrollbar, tooltips drop DOWN instead of up to stay in viewport

Major hardening: bulletproof superadmin router with try/except on every endpoint, fix exception handler names, validate tokens before dashboard, add QoL info tooltips to all admin pages

Enhance embed page: step-by-step widget guide, live preview buttons, platform instructions (WordPress/Squarespace/Webflow/Shopify/HTML), dynamic theme/position selector, fix widget preview URL

Fix 500 errors: analytics/funnel used non-existent event_type, analytics/intents used non-existent metadata_json. Add defensive JSON parsing to all API helpers to prevent 'Unexpected token' errors

Phase 1.2+5.1+6.2+6.5: Book cover upload with resizing, conversion funnel analytics, intent distribution, backup system, CI/CD pipeline

CRITICAL: Fix </script> inside template literal breaking ALL JS after embed code generator, fix invalid dummy bcrypt hash causing login 500 errors

Phase 4+5: Fix rate limiter paths (/api/v1 -> /api/chat|auth|admin), add SecurityHeadersMiddleware (HSTS, XSS, CSRF, CSP), fix QA export auth, fix route ordering

Fix critical bugs: remove duplicate showModal/closeModal override, fix FastAPI route ordering conflicts (sessions/search before sessions/{id}, qa/import+export before qa/{id}), add missing visitor_name/turn_count to session list response

Phase 1: Add Conversations Viewer, Custom Q&A Manager, Export Center — 15 new API endpoints, 3 new admin pages, CustomQA model, message annotations, flagging, search, CSV import/export

Deep audit fix: add missing model columns (blocked, rating, tokens_used, out_of_scope_message, buy_url, preview_url), fix .get() calls, fix ingest doc creation, add track-click endpoint, add column migrations, fix email crash, fix audit log field names, enrich superadmin author list

Wire all frontend features to real backend APIs: widget-config, profile, personality, notifications, smart-links, token-usage, grant-by-email, fix password endpoint

Premium redesign: admin panel, superadmin panel, fix widget API paths, fix analytics 500

Fix: analytics uses AnalyticsEvent.timestamp not created_at; fix security import

Fix: accept any email/username at login, add is_superadmin to response, fix [object Object] error display

Restructure project for HF Spaces deployment