Add enterprise growth APIs, billing, admin UI, and test suite.

P0 security: async backup, widget CORS, Redis auth.

Add SuperAdmin retailer API keys with priority over env and free scraping.

Add GOOGLE_BOOKS_API_KEY for authenticated Books API lookups.

Refactor admin API into service and repository layers.

Add publish-help contact form with support email routing.

Revert "Complete platform presence stack with ISBN enrichment and manual overrides."

Complete platform presence stack with ISBN enrichment and manual overrides.

Fix 429 rate limits and show friendly errors in widget.

feat: show IP address in sessions + persistent login until logout - Add ip_address field to ChatSession model (VARCHAR 45, handles IPv4+IPv6) - Store real client IP at session/init time via get_real_ip() - Expose ip_address in /sessions list and /sessions/{id}/transcript responses - DB migration: ip_address column added to chat_sessions - Bump REFRESH_TOKEN_EXPIRE_DAYS from 7 to 30 days (stay logged in 1 month) - Fix auth-client.js: refreshAccessToken only clears session on 401/403, not on network/5xx errors (HF cold-start safe) - Fix restoreSession: keeps session alive when refresh fails transiently, only clears on explicit auth rejection

feat: Phases 1-5 production improvements + 8 bug fixes

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Enforce brief sales-focused chatbot rules with spoiler guard and buy CTAs.

Fix auth session expiry with shared auto-refresh client for admin panels.

Feat: auto-seed superadmin from SUPER_ADMIN_USER/SUPER_ADMIN_PASS env vars on startup

Restructure project for HF Spaces deployment