feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

.gitea/workflows/ci-deploy.yml

@@ -87,12 +87,11 @@ jobs:
                  && rm -rf node_modules \
                  && npm ci --no-audit --no-fund )
 
-      # Report the existing advisory baseline without blocking unrelated deploys. Promote this to a
-      # hard gate after the upstream no-fix advisories in the current toolchain are cleared.
-      - name: Audit frontend production dependencies
-        continue-on-error: true
+      # Moderate React Router advisories remain documented and mitigated; high/critical findings
+      # in either production or test/browser tooling block the build.
+      - name: Audit frontend dependencies
         working-directory: job-tracker-ui
-        run: npm audit --omit=dev --audit-level=high
+        run: npm audit --audit-level=high
 
       - name: Test frontend
         working-directory: job-tracker-ui
@@ -100,6 +99,14 @@ jobs:
         # whitelist silently skipped new suites and let two regressions reach main.
         run: npm test -- --watchAll=false --runInBand
 
+      - name: Install browser smoke runtime
+        working-directory: job-tracker-ui
+        run: npx playwright install --with-deps chromium
+
+      - name: Test browser smoke flows
+        working-directory: job-tracker-ui
+        run: npm run test:e2e
+
       - name: Build frontend
         working-directory: job-tracker-ui
         env: