feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/product/business-model.md

@@ -1,3 +1,11 @@
 # business-model
 
-TODO: Complete documentation.
+Jobjakt uses capability-based plans rather than limiting the number of jobs or documents. Free accounts
+receive core tracking, basic Career Profile/CV features, 250 MB storage, and bounded AI usage.
+Premium/Admin accounts receive advanced AI, Premium themes, automation, analytics, 5 GB storage, and
+higher request/token ceilings.
+
+Stripe hosted Checkout, customer-portal sessions, signed subscription webhooks, persisted customer /
+subscription state, and Premium-role provisioning are implemented. Production activation still needs
+the operator-created monthly price, portal configuration, webhook registration, and credentials in
+`BLOCKERS.md`. Existing user documents remain readable and exportable after downgrade.

docs/product/roadmap.md

@@ -1,5 +1,11 @@
 # Jobjakt Product Roadmap
 
+Status reconciled 2026-07-31: Phases 1–8 are implemented in the repository. Phase 8 (SaaS
+commercialisation) remains operationally blocked on Stripe activation and production verification.
+The implementation roadmap folds public profile and SaaS preparation into its Phase 7; this product
+roadmap keeps them as Phases 7 and 8. Portfolio content stays inside public CVs; separate portfolio
+hosting is intentionally out of scope until it has requirements that public CVs cannot satisfy.
+
 ## Purpose
 
 Defines the strategic direction of Jobjakt.
@@ -312,9 +318,9 @@ Possible future features:
 - Salary insights. ✅ Dashboard groups comparable tracked ranges by currency and pay period (2026-07-31).
 - Career analytics.
 - Skill recommendations.
-- Learning paths.
-- Recruiter visibility.
-- Portfolio hosting.
+- Learning paths. ✅ Deterministic job-specific skill gaps can be marked learned or dismissed; external course integrations remain out of scope (2026-07-31).
+- Recruiter visibility. ✅ Public CV links include recruiter-friendly PDF download (2026-07-31); discovery, accounts, and messaging remain intentionally unscoped.
+- Portfolio hosting. ➖ Separate hosting is intentionally out of scope; public CV projects and custom sections cover the current sharing need.
 
 ---
 
@@ -326,4 +332,4 @@ Do not:
 - Sacrifice simplicity for complexity.
 - Add features because competitors have them.
 
-Always prioritise user value.
+Always prioritise user value.