feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/production-readiness-review.md

@@ -1,5 +1,8 @@
 # Production readiness review
 
+> **Historical snapshot (2026-07-19).** The current production blockers are maintained in
+> `BLOCKERS.md`; current implementation status is in `docs/implementation-roadmap.md`.
+
 > 2026-07-19, before the first production deployment after the Phase 4/5 architecture changes.
 > Companion to `docs/phase-5-completion-report.md` and `docs/infrastructure/database-ownership.md`.
 >
@@ -115,7 +118,7 @@ config. See `docs/infrastructure/runner-investigation.md`.
 ### 5. Logging is console-only — **accepted for now**
 
 `builder.Logging` clears providers and adds Console and Debug. Adequate under Docker (captured by
-`docker logs`), but there is no retention, no structure, and no aggregation. Acceptable for a
+`docker logs`), and production output is structured JSON, but there is no configured retention or aggregation. Acceptable for a
 self-hosted single-node deployment; revisit if that changes.
 
 ### 6. No global exception handler — **minor**