fix production issues

docs/ops/phase4-module-boundaries.md

@@ -0,0 +1,41 @@
+# Module boundaries for possible Phase 4 extracts
+
+**Purpose:** Document current monolith seams so a future extract does not require archaeology. Not a license to split today (ADR-003).
+
+## Notification / jobs
+
+| Piece | Path |
+|-------|------|
+| Worker entry | `apps/api/src/workers/index.ts` |
+| Job loop | `apps/api/src/workers/jobs.ts` |
+| Outbox processing | `apps/api/src/services/notificationService` (and related) |
+| Compose | `api-worker` in `docker-compose*.yml` |
+
+**Seam:** DB outbox + Redis pub for IN_APP. Extract later = move worker package + keep outbox schema shared or via events.
+
+## Payments / webhooks
+
+| Piece | Path |
+|-------|------|
+| Webhook router | `apps/api/src/modules/webhooks/` |
+| Payments | `apps/api/src/modules/payments/` |
+| Billing | `apps/api/src/modules/billing/` |
+| Subscriptions | `apps/api/src/modules/subscriptions/` |
+
+**Seam:** Provider signature verify → idempotent intent/invoice update → outbox side effects. Extract later = webhook ingress service writing to the same billing tables or a command queue.
+
+## Media
+
+| Piece | Path |
+|-------|------|
+| Storage drivers | `apps/api/src/lib/storage` |
+| Upload HTTP | `apps/api/src/http/upload` (and module callers) |
+| Compose MinIO | `minio` profile in dev compose |
+
+**Seam:** API accepts upload → stores object key → optional worker job for virus scan / derivatives. Extract later = media service owning bucket + callback to API.
+
+## Shared that must not fork casually
+
+- Prisma schema / migrations (`packages/database`)
+- Auth tokens / tenant `companyId` middleware
+- Plan catalog (`packages/types` planCatalog)