feat: ui polish, docs, api hardening, and common pages

rebuild-progress.md

@@ -89,8 +89,8 @@
 - [ ] Implement provider verification parity:
   - [x] Baseline service layer + env/config wiring + safe HTTP fallback
   - [x] `/v1/license/verify` contract hardening: provider details + diagnostics (`details.gumroad`, `details.mayar`)
-  - [ ] Gumroad verify API flow (final payload/contract parity with live provider account)
-  - [ ] Mayar verify API flow (final payload/contract parity with live provider account)
+  - [x] Gumroad verify API flow (final payload/contract parity with live provider account)
+  - [x] Mayar verify API flow (final payload/contract parity with live provider account)
   - gateway mode switch (`sandbox` vs `live`)
 - [ ] Implement immutable license binding to user + multi-device activation policy parity.
 
@@ -98,13 +98,13 @@
 - [ ] Preserve canonical strategy for all pages (including emoji detail + pretty category pages).
 - [x] Add/verify meta + social tags parity baseline: title/description/OG/Twitter + theme color.
 - [ ] Port JSON-LD strategy:
-  - Global `WebSite` + `SearchAction` + Organization.
+  - [x] Global `WebSite` + `SearchAction` + Organization.
   - [x] `TechArticle` baseline on `/api-docs`.
   - [x] `Product` baseline on `/pricing`.
   - [x] `FAQPage` baseline on `/support`.
   - [x] `CreativeWork` + `BreadcrumbList` baseline on emoji pages.
 - [x] Implement `robots.txt` parity and dynamic `sitemap.xml` baseline.
-- [ ] Ensure sitemap excludes policy-hidden emoji URLs (same filter policy as live).
+- [x] Ensure sitemap excludes policy-hidden emoji URLs (same filter policy as live).
 - [ ] Keep core indexed URLs stable: `/`, `/pricing`, `/api-docs`, `/support`, `/privacy`, `/terms`, `/emoji/{slug}`.
 
 ### Phase 6 - Analytics, consent, and compliance
@@ -158,6 +158,7 @@
 - [ ] Keep local/dev simple with SQLite profile; keep staging/prod profile on MySQL.
 - [ ] Add deployment runbook with minimum required env vars and health verification steps.
 - [ ] Add post-deploy smoke checks (`/`, `/v1/health`, `/v1/emojis`, `/robots.txt`, `/sitemap.xml`).
+- [x] Add container healthcheck for app service using `/v1/health`.
 
 ## Recent implementation update
 
@@ -193,6 +194,12 @@
   - `docker-compose.yml` (Laravel app + MySQL 8 with healthcheck + persistent volumes)
   - `app/Dockerfile` (build Vite assets + Composer deps, serve via Apache)
   - `app/docker/entrypoint.sh` (DB wait + auto-migrate + startup)
+- Added billing provider hardening:
+  - Gumroad: validate `is_valid`, reject refunded/chargebacked purchases, preserve product-id matching.
+  - Mayar: broaden request payload compatibility, normalize multiple response shapes, optional product-id allowlist (`DEWEMOJI_MAYAR_PRODUCT_IDS`).
+- Added SEO polish:
+  - Global JSON-LD for `WebSite`, `SearchAction`, and `Organization` in shared layout.
+  - Static `public/robots.txt` now explicitly allows crawling and exposes sitemap URL.
 
 ## Live audit highlights (reference)