fix plan issues

docs/AGENTS.md

@@ -0,0 +1,13 @@
+# Agent Instructions
+
+Always communicate in English.
+
+Use English for:
+- Responses
+- Code comments
+- Documentation
+- Commit messages
+- Pull request descriptions
+- Error analysis
+
+Only use another language if explicitly requested.

docs/DESIGN_MIGRATION_REPORT.md

@@ -0,0 +1,47 @@
+# RentalDriveGo Phase 16 Design Migration
+
+## Outcome
+
+The Phase 16 visual system has been applied at source level to the legacy application front ends in this archive:
+
+- `homepage`: retained as the authoritative Phase 16 marketing implementation already present in the legacy archive.
+- `admin`: migrated to the Phase 16 token palette and component treatment; navigation was rebuilt as a responsive, accessible application shell.
+- `dashboard`: migrated to the same semantic surfaces, typography, borders, shadows, focus treatment, dark theme, and blue/orange action hierarchy.
+- `carplace`: migrated to the same public-site surfaces, conversion treatment, cards, forms, dark theme, and brand naming.
+- `api`: intentionally unchanged. A visual migration should not casually rewrite business logic because that is how weekends disappear.
+
+## Design rules applied
+
+- Blue is the operational primary color.
+- Orange is reserved for conversion emphasis and focus visibility.
+- Green is restored to success/status meaning instead of being used as a disguised primary action.
+- Light and dark themes share semantic tokens rather than unrelated hard-coded palettes.
+- English and French remain LTR; Arabic continues to use document RTL and an Arabic font fallback stack.
+- Interactive controls use a minimum 44px target, visible focus treatment, reduced-motion handling, and high-contrast fallbacks.
+- Cards and panels use the Phase 16 radius, border, surface, and shadow hierarchy.
+- The retired `RentalDriveGo` name was replaced with `RentalDriveGo` throughout all frontend source files.
+
+## Important source finding
+
+The supplied `RentalDriveGo_Phase16_Evidence_Package_v1.0.zip` is an evidence and launch-governance package, not the Phase 16 source repository. It contains 98 files, while its manifest describes a separate 648-file repository that was not included. The legacy archive already contained most of that repository's marketing homepage implementation: 182 files match the Phase 16 manifest checksums exactly. That embedded homepage implementation was therefore used as the reliable visual source of truth rather than fabricating a new design from launch paperwork.
+
+## Files added
+
+- `admin/src/styles/phase16-tokens.css`
+- `dashboard/src/styles/phase16-tokens.css`
+- `carplace/src/styles/phase16-tokens.css`
+- `scripts/validate-phase16-design.mjs`
+- `DESIGN_MIGRATION_REPORT.md`
+- `PHASE16_DESIGN_MIGRATION_MANIFEST.json`
+
+## Validation performed
+
+- Parsed 633 TypeScript and TSX source files with TypeScript 5.8 syntax validation: passed.
+- Checked 53 CSS files for balanced rule blocks: passed.
+- Verified all three migrated apps import the Phase 16 tokens: passed.
+- Verified no retired `RentalDriveGo` branding remains in frontend source: passed.
+- Ran `node scripts/validate-phase16-design.mjs`: passed.
+
+## Validation not claimed
+
+A full dependency-backed build and browser regression suite was not run. The supplied legacy archive omits its root workspace configuration and the local packages referenced as `@rentaldrivego/types` and `@rentaldrivego/database`. The Phase 16 evidence upload also omits the source repository and dependency lockfile it references. Those are packaging defects in the inputs, not facts to conceal with optimistic prose.

docs/MANUAL_SUBSCRIPTION_PAYMENTS.md

@@ -0,0 +1,23 @@
+# Manual subscription payments
+
+This project implements bank-transfer and check collection as first-class subscription billing paths. Evidence submission is explicitly **not** settlement: only a fresh-2FA finance confirmation of cleared funds creates a successful offline payment attempt, pays the canonical billing invoice, and activates or renews the subscription.
+
+## Safe rollout
+
+1. Apply the `20260809190000_manual_subscription_payments` migration and deploy with all new flags disabled.
+2. Configure a private persistent, encrypted-at-rest `FILE_STORAGE_ROOT`; set both private-storage confirmation flags only after verifying the mounted storage; configure a fail-closed scanner executable, bank/check payer instructions, billing contacts, valid IANA timezones, and finance collections owners.
+3. Enable `MANUAL_PAYMENT_EVIDENCE_UPLOAD_ENABLED`, then `MANUAL_SUBSCRIPTION_PAYMENTS_ENABLED` and the desired manual method flags.
+4. Enable `SUBSCRIPTION_COLLECTIONS_NOTIFICATIONS_ENABLED`; verify the AR/EN/FR snapshots, outbox delivery, 48-hour call task, and escalation queue.
+5. Enable `SUBSCRIPTION_AUTOMATIC_SUSPENSION_ENABLED` only after observing a full reminder/grace cycle. Suspension starts after 30 calendar grace days and rechecks payment, overrides, and configuration atomically.
+
+Manual methods remain hidden unless their instructions and evidence-scanning pipeline are ready. The non-production `PAYMENT_EVIDENCE_SCANNER_MODE=stub-clean` option exists only for local tests; production requires `PAYMENT_EVIDENCE_SCANNER_PATH`.
+
+## Operational invariants
+
+- Subscription billing has one canonical `BillingInvoice`; legacy `SubscriptionInvoice` rows are compatibility links only.
+- A scheduled renewal is reused by the next manual checkout rather than duplicated.
+- Manual confirmation requires the full current MAD balance, matching collection method, clean same-invoice evidence, a unique normalized external reference, a unique idempotency key, a clearance timestamp, and a funds-verified attestation.
+- Initial purchases activate from confirmation time. Renewals extend from the original expiration, including late confirmations after suspension.
+- Evidence is stored privately with no public URL, quarantined before scanning, served only through authorized routes, and immutable after submission.
+- Collections reminders are recipient-specific and localized using contact preference, linked employee preference, then company default. Only Arabic, English, and French can be enabled.
+- Payment resolution cancels open call tasks and suppresses queued collections reminders.

docs/NAVBAR_FOOTER_REFACTOR_REPORT.md

@@ -0,0 +1,33 @@
+# RentalDriveGo Public Chrome Refactor Report
+
+## Completed
+
+1. Extracted the dashboard public navbar into `components/public/PublicNavbar.tsx`.
+2. Extracted the dashboard public footer into `components/public/PublicFooter.tsx`.
+3. Added `PublicPageLayout` as the reusable composition layer for authentication and onboarding pages.
+4. Updated sign-in, create-account, forgot-password, reset-password, verify-email, onboarding, and invitation pages to use the public component API.
+5. Preserved legacy component paths through compatibility exports.
+6. Moved carplace navbar/footer assembly out of the Next.js route layout and into reusable public components.
+7. Added active-page semantics to dashboard sign-in and create-account navbar actions.
+8. Added focused tests and implementation documentation.
+
+## Deliberately unchanged
+
+- Authentication requests and API endpoints
+- Redirect behavior between carplace, dashboard, and admin applications
+- Language and theme persistence
+- Embedded workspace behavior
+- Authenticated dashboard and admin navigation
+
+## Validation performed
+
+- Parsed all TypeScript and TSX source files successfully.
+- Verified all relative and `@/` local imports resolve.
+- Verified every `use client` directive remains the first statement.
+- Verified sign-in and create-account import and render `PublicPageLayout`.
+- Verified the carplace route layout no longer assembles navbar/footer inline.
+- Verified embedded password-recovery navigation preserves `embedded=1`.
+
+## Validation limitation
+
+A complete Next.js build was not executed because this archive does not include the monorepo root, workspace packages, lockfile, or installed dependencies referenced by the application package files. Static source validation was completed instead; pretending that equals a production build would be charmingly irresponsible.

docs/PHASE16_OPERATIONAL_UI_REPORT.md

@@ -0,0 +1,95 @@
+# RentalDriveGo Phase 16 Operational UI Migration Report
+
+**Date:** 2026-06-25  
+**Scope:** Operator dashboard and platform admin  
+**Design authority:** Existing Phase 16 homepage implementation and its blue/orange semantic design system
+
+## Result
+
+The dashboard and admin applications now use the same visual language as the Phase 16 homepage rather than behaving like separate products. The migration changes shared shells, global tokens, navigation, page hierarchy, cards, forms, tables, status treatments, responsive behavior, dark mode, RTL behavior, and focus states. API business logic and route contracts were deliberately left unchanged.
+
+## Repository recovery
+
+The previous navbar/footer refactor archive omitted the `homepage` and `api` applications. This package was rebuilt from the complete Phase 16 archive, then overlaid with the public navbar/footer refactor before the operational UI migration. The final repository contains:
+
+- `homepage`
+- `carplace`
+- `dashboard`
+- `admin`
+- `api`
+- validation scripts and documentation
+
+## Shared visual system
+
+Both operational applications now consume matching `phase16-tokens.css` files with:
+
+- Homepage blue as the operational action color
+- Orange reserved for conversion, focus, warning, and selected emphasis
+- Shared light and dark surface mappings
+- Shared 10 px, 16 px, 24 px, and 32 px radius scale
+- Shared 44 px minimum interactive target
+- Shared 76 px topbar and 272 px desktop sidebar dimensions
+- Shared card, overlay, and focus shadows
+- Inter for Latin content and Noto Sans Arabic fallbacks for Arabic
+
+## Dashboard changes
+
+- Rebuilt the authenticated shell with the Phase 16 page background, sidebar, sticky topbar, content width, and responsive spacing.
+- Reworked sidebar branding, active navigation, user card, status marker, RTL logical borders, and mobile behavior.
+- Reworked the topbar search, page title, status pill, notifications, account controls, and semantic icon buttons.
+- Migrated all 19 dashboard routes to the shared page-heading or hero pattern.
+- Applied shared styling to overview metrics, quick actions, reservations, contracts, online reservations, fleet, customers, team, reviews, complaints, offers, billing, subscription, reports, notifications, and settings.
+- Preserved printable contract styling as a document surface while aligning its surrounding application controls.
+
+## Admin changes
+
+- Rebuilt the admin shell with the same Phase 16 sidebar, topbar, page background, status treatment, mobile drawer, language controls, theme controls, and user card.
+- Migrated all 12 admin routes to the shared page-heading or hero pattern.
+- Standardized companies, company details, renters, administrators, billing, pricing, containers, audit logs, notifications, menu management, site configuration, and overview pages.
+- Converted operational create/save/preview actions from orange to homepage blue. Orange remains available for promotions, conversion previews, warnings, and focus.
+- Standardized dynamic form controls through the shared `.field` utility.
+
+## Shared component and CSS contract
+
+The main reusable classes are:
+
+- `.rdg-app-shell`
+- `.rdg-workspace`
+- `.rdg-sidebar`
+- `.rdg-nav-item`
+- `.rdg-topbar`
+- `.rdg-app-main`
+- `.rdg-app-content`
+- `.rdg-page-hero`
+- `.rdg-page-heading`
+- `.rdg-page-kicker`
+- `.panel`
+- `.card`
+- `.field`
+- `.btn-primary`
+- `.btn-secondary`
+- `.btn-conversion`
+
+## Behavior preserved
+
+- Existing routes and URL structure
+- Authentication and access guards
+- API calls and data mutations
+- English, French, and Arabic support
+- True RTL layout behavior through logical properties
+- Light, dark, and system theme behavior
+- Embedded authentication behavior through `embedded=1`
+- Print behavior for contracts
+
+## Validation completed
+
+- 596 TypeScript/TSX source files parsed with zero syntax failures.
+- 190 local and alias imports checked in admin/dashboard with zero unresolved paths.
+- 31 operational route pages checked for a Phase 16 page heading or hero.
+- CSS brace balance checked for the migrated stylesheets.
+- Shared shell, token, responsive, forced-color, auth-layout, and retired-brand assertions passed.
+- Final archive integrity is checked after packaging.
+
+## Build limitation
+
+A production Next.js build was not run because the supplied archive does not include the monorepo root, root lockfile, root workspace configuration, installed dependencies, or the referenced `@rentaldrivego/types` workspace. Each application invokes that absent workspace in its `prebuild` script. Claiming a clean production build under those conditions would be fiction with a progress bar.

docs/PHASE16_OPERATIONAL_VALIDATION_REPORT.md

@@ -0,0 +1,40 @@
+# Phase 16 Operational UI Validation Report
+
+**Validated:** 2026-06-25  
+**Result:** Static migration gates passed
+
+## Passed checks
+
+| Check | Result |
+|---|---:|
+| Frontend/API source TypeScript and TSX parsed | 596 files, 0 syntax failures |
+| Admin/dashboard local and `@/` imports resolved | 190 imports, 0 unresolved |
+| Dashboard operational routes using Phase 16 heading/hero | 19 of 19 |
+| Admin operational routes using Phase 16 heading/hero | 12 of 12 |
+| Dashboard/admin token files present | Passed |
+| Shared sidebar, topbar, shell, panel, field, and action contracts present | Passed |
+| CSS brace balance | Passed |
+| Light/dark and Arabic RTL token mappings present | Passed |
+| Reduced-motion and forced-colors rules present | Passed |
+| Shared sign-in/create-account public layout retained | Passed |
+| Shared carplace navbar/footer components retained | Passed |
+| Retired `RentalDriveGo` brand in dashboard/admin source | 0 matches |
+| Complete app directories retained | `homepage`, `carplace`, `dashboard`, `admin`, `api` |
+
+## Reproducible design gate
+
+Run this from the extracted repository root:
+
+```bash
+node scripts/validate-phase16-design.mjs
+```
+
+Expected output:
+
+```text
+Phase 16 dashboard/admin design checks passed.
+```
+
+## Not claimed
+
+A production build, type-check against installed dependencies, integration test run, and browser visual regression run are not claimed. The supplied archive lacks the root workspace, root lockfile, `@rentaldrivego/types` package, and installed dependencies required by every application `prebuild` script.

docs/SECURITY_HARDENING_APPLIED.md

@@ -0,0 +1,41 @@
+# Security Hardening Applied
+
+This bundle applies the highest-risk items from the hardened security fix plan to the uploaded apps source.
+
+## Applied changes
+
+- Added explicit subscription read/write/full middleware and moved sensitive mutations to write/full checks.
+- Hardened backend route authorization for reservations, customers, vehicles, analytics, payments, reviews, complaints, team, companies, offers, notifications, billing, and subscription actions.
+- Blocked AGENT access to manager/owner actions including reservation lifecycle transitions, analytics, payments, review replies/reminders, team lists/stats, license image reads, license validation, and complaint mutations.
+- Disabled public Swagger/OpenAPI exposure in production unless `ENABLE_PUBLIC_API_DOCS=true` is explicitly set.
+- Added CSRF-style Origin/Referer enforcement for cookie-authenticated browser mutations.
+- Added forwarding-header sanitization middleware and stripped spoofable forwarding headers from the dashboard API proxy.
+- Changed dashboard redirects to use the configured canonical dashboard URL instead of request-supplied forwarded host headers.
+- Blocked anonymous `/storage` access to reservation photo paths and classified reservation uploads as private storage.
+- Tightened image upload limits, file count limits, magic-byte validation, extension consistency, and basic image dimension limits.
+- Added a dedicated webhook rate limiter and raw body size limits.
+- Hardened AmanPay webhook signature verification so invalid signature length returns false instead of throwing.
+- Hardened webhook idempotency by rejecting missing provider event IDs and allowing stale PROCESSING records to retry after a timeout.
+- Hardened PayPal capture by binding capture to company, reservation, local pending payment status, provider completion status, amount, and currency.
+- Restricted public site/carplace booking flows to ACTIVE/TRIALING companies and AVAILABLE published vehicles.
+- Capped public Carplace pagination and metadata size.
+- Replaced rank-only admin role checks with explicit role allowlists so SUPPORT no longer implicitly outranks FINANCE.
+- Required fresh admin 2FA before replacing an already-enabled admin TOTP setup.
+- Started storing admin reset tokens and employee email verification tokens as hashes while preserving legacy raw-token lookup during migration.
+
+## Validation performed
+
+The sandbox did not include a usable installed workspace dependency tree, so full `npm test` / `npm run type-check` could not be executed from the extracted bundle. A TypeScript syntactic transpile check was run against all changed TypeScript files and passed.
+
+## Important remaining work
+
+This patch does not fully complete every item in the hardening plan. The remaining work should be handled before production sign-off:
+
+- Add/expand DB-backed audit logging for every sensitive mutation.
+- Add database-backed idempotency for public booking instead of the current process-local cache.
+- Add full route authorization matrix tests across unauthenticated, AGENT, MANAGER, OWNER, wrong tenant, suspended, paused, and past-due states.
+- Add storage migration scripts to move existing public reservation photos into private storage.
+- Finish token migration for review tokens and any remaining invitation/public access tokens if schema support exists.
+- Add full payment provider merchant/receiver-account validation if provider config is stored per company.
+- Add dependency/lockfile CI gates from the plan.
+