feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

.env.example

@@ -20,6 +20,10 @@ AUTH_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
 AUTH_ALLOW_REGISTRATION=false
 TURNSTILE_SITE_KEY=
 TURNSTILE_SECRET_KEY=
+# Optional hosted Stripe Checkout. Configure all three values and the customer portal before enabling billing.
+STRIPE_SECRET_KEY=
+STRIPE_PRICE_PREMIUM=
+STRIPE_WEBHOOK_SECRET=
 AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
 # Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
 # MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).
@@ -53,7 +57,7 @@ GROQ_MODEL=llama-3.3-70b-versatile
 
 # Optional: only needed if you want the UI to call a non-default API base URL.
 # In production the UI defaults to `/api`.
-REACT_APP_API_BASE_URL=
+NEXT_PUBLIC_API_BASE_URL=
 
 # Used by docker-compose.yml (email / password resets / notifications)
 APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk