feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/release-checklist.md

@@ -1,5 +1,8 @@
 # Release checklist
 
+> **Historical snapshot (2026-07-19).** The current release gate and external dependencies are
+> documented in `.gitea/workflows/ci-deploy.yml`, `docs/implementation-roadmap.md`, and `BLOCKERS.md`.
+
 > 2026-07-19. State of the build before the first production deployment after the Phase 4/5
 > architecture changes. Companion to `deploy/first-production-deployment.md` (how to deploy),
 > `docs/production-readiness-review.md` (what was audited) and
@@ -56,9 +59,9 @@ Full evidence: `docs/infrastructure/runner-investigation.md`.
 |---|---|---|
 | Production is many commits behind | High | The first deploy applies the whole Phase 4/5 change at once. Reconciler builds ~12 tables against real data for the first time. |
 | Reconciler path unproven on your data | Medium | Verified on containers and on a real SQLite dev database — not on production. This is what the backup is for. |
-| End-to-end journey unwalked | Medium | No one has driven the authenticated flow from empty profile to recorded outcome. Sign-in needs a password, so the browser checks belong to you. |
+| Production journey unwalked | Medium | The CI-gated local browser suite covers login, saved-job creation, Career Workspace, and public CV/PDF. The same authenticated and OAuth checks still require production credentials. |
 | Rollback loses new-table data | Medium | A code rollback keeps everything. A *database restore* discards rows created since the dump. Keep the deploy window quiet. |
-| Logging is console-only | Low | Fine under Docker; no retention or aggregation. |
+| Logging is structured JSON on stdout | Low | Compose retains three 10 MB files per service; aggregation remains deployment-owned. |
 | No global exception handler | Low | Unhandled errors return a bare 500 with no correlation id. No stack leaks outside Development. |
 | `ClientErrorsController` is anonymous | Low | By design — browser error reports must work before sign-in. Size-limited and truncated; stores nothing. |
 | Prompt quality unmeasured | Low | Interview generation gets richer context; whether the questions are *better* is a judgement no test makes. |