Fix admin growth-page JS shims and client_access migrations.

Add email list sync UI, Phase 4 user fields, and startup migrations.

P0 security: async backup, widget CORS, Redis auth.

Add mandatory SuperAdmin TOTP enrollment and production delivery skills.

Add SuperAdmin retailer API keys with priority over env and free scraping.

Fetch list prices during platform presence scans where retailers allow it.

Implement Enterprise Worth Roadmap (R-139–R-173).

Revert "Complete platform presence stack with ISBN enrichment and manual overrides."

Complete platform presence stack with ISBN enrichment and manual overrides.

fix: cover+genre now actually persist in DB

feat: deep book metadata extraction - author bio, genre, ratings, pages

feat: book URL import - 10 platforms, 3-step UI, scraper service

feat: show IP address in sessions + persistent login until logout - Add ip_address field to ChatSession model (VARCHAR 45, handles IPv4+IPv6) - Store real client IP at session/init time via get_real_ip() - Expose ip_address in /sessions list and /sessions/{id}/transcript responses - DB migration: ip_address column added to chat_sessions - Bump REFRESH_TOKEN_EXPIRE_DAYS from 7 to 30 days (stay logged in 1 month) - Fix auth-client.js: refreshAccessToken only clears session on 401/403, not on network/5xx errors (HF cold-start safe) - Fix restoreSession: keeps session alive when refresh fails transiently, only clears on explicit auth rejection

feat: proper visitor analytics system - New Visitor model (visitor_uid + fingerprint fallback, first_seen/last_seen/page_views, geo, device) - VisitorRepository with upsert + analytics queries - visitor_tracker.py: record_visitor() upserts on every session/init - session/init accepts visitor_uid in request body (HF-Spaces iframe-safe, no cookies) - 4 new analytics endpoints: /visitors /geo /devices /sessions/stats - geo.py: region extraction + X-Real-IP support - DB migration: visitor_uid column on chat_sessions - ARCHITECTURE.md updated

feat: Phases 2B + 3B — semantic Q&A and vector store fixes

Refactor: complete 10/10 modularity — superadmin/routers/, core/startup/, pipeline/generation.py, slim main.py

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Unify token tracking, smart links, and personality settings across admin and chat.

Fix chat session init crash and improve embed reliability

Restructure project for HF Spaces deployment