feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/phase-5-completion-report.md

@@ -1,5 +1,7 @@
 # Phase 5 — Intelligent Application Workspace: completion report
 
+> **Historical snapshot (2026-07-19).** Current release dependencies are tracked in `BLOCKERS.md`.
+
 > 2026-07-19. What was built, what was decided, what is still risky, and what should come next.
 > Companion to `docs/architecture/application-workspace.md` and
 > `docs/infrastructure/database-ownership.md`.
@@ -135,13 +137,15 @@ makes.
 
 ## Future improvements
 
+This dated list is superseded by the current roadmap and debt ledger. Authorization and lifecycle
+event emission are implemented; the placeholder Portfolio/Notes workspace tabs were removed because
+projects belong in public CVs and application notes remain in the existing application editor.
+
 - **Resolve the runner**, then verify the full stack in CI and deploy. Everything else is downstream.
-- **Explicit `[Authorize]`** on the pre-Phase-5 controllers, paired with a dev-mode decision.
-- **AI cover-letter actions** — improve, shorten, expand, tone, tailor. `CoverLetterVersion.AiAction`
-  already models them; only the modes and UI are missing.
-- **Portfolio section** (workspace milestone 8) is still a placeholder.
-- **Emit the new lifecycle events.** `InterviewScheduled`, `InterviewCompleted`, `OfferReceived`,
-  `FollowUpCompleted` are *interpreted* by the timeline but only `FollowUpSet` and `StatusChanged` are
-  currently emitted. Wiring the emitters is small and would make the timeline noticeably richer.
+- ~~**Explicit `[Authorize]`** on the pre-Phase-5 controllers~~ — implemented.
+- **AI cover-letter actions** — separate improve/shorten/expand actions remain intentionally unscoped;
+  the shipped flow generates by tone and keeps user editing/version history authoritative.
+- ~~**Portfolio section**~~ — removed; public CV projects/custom sections cover the current scope.
+- ~~**Emit the new lifecycle events**~~ — implemented through `JobLifecycleEvents`.
 - **Checklist GET writes on read** (seeding + auto-completion sync). Correct and idempotent, but it
   makes a GET non-cacheable; worth revisiting if the workspace ever needs to scale reads.