Changelog

Added

• Storage — Cloudflare R2 wired end-to-end with a working avatar upload (validated upload + private serving route).
• Security headers — baseline headers on every response, plus a production Content-Security-Policy.
• Environment validation — fail-fast zod schema validates required env on startup.

Fixed

• Styled 500 error boundary so uncaught render errors no longer blank the screen.

Added

• Email/password auth with verification, social login (graceful degradation), and sessions on D1.
• Stripe subscriptions and one-time lifetime purchase with plan-based route guards.
• Path-based i18n (en/zh), per-locale SEO, and a real-data admin console.