chore: sync in-progress work across marketing, admin, API and tests

Snapshot of uncommitted work that had accumulated in the tree alongside
the Turnstile changes:

- marketing pages, SEO helpers (lib/seo.ts, lib/marketing/) and
  structured data
- admin billing actions and a per-user portfolio view, plus an admin
  error boundary
- rate limiting (lib/rate-limit.ts) applied across the /api/v1 surface
- CSP and proxy adjustments, accounting/webhook lib updates
- Playwright config and an e2e/unit test suite
- next bumped to ^16.3.4 with the lockfile regenerated
- generated AGENTS.md / CLAUDE.md

Authored by other sessions working in this tree; committed here so the
Turnstile work could be pushed without leaving the tree dirty.
Typecheck passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/plan-limits.ts

@@ -1,7 +1,7 @@
-import { eq } from "drizzle-orm"
+import { eq, sql } from "drizzle-orm"
 import { db } from "@/lib/db"
-import { profiles } from "@/lib/db/schema"
-import { PLAN_LIMITS } from "@/lib/stripe/plans"
+import { profiles, properties, tenants } from "@/lib/db/schema"
+import { PLAN_LIMITS, checkLimit } from "@/lib/stripe/plans"
 import { getUserStorageBytes } from "@/lib/storage"
 import type { Plan } from "@/types"
 
@@ -39,3 +39,43 @@ export async function checkStorageLimit(
   }
   return null
 }
+
+// ── countable resource caps ──────────────────────────────────────────────────
+// These live here, not inline in route handlers, because there is more than one
+// way into the app: the session routes AND the public v1 API both create
+// properties. When the check was written inline, v1 simply did not have it and a
+// Starter user could mint an API key and create unlimited properties. Every
+// creation path MUST call the helper for its resource — mirroring the same rule
+// the upload allowlist follows in lib/storage.ts.
+
+/**
+ * Returns a user-facing error message if the owner is at their plan's property
+ * cap, otherwise null. Call before every property insert, on every entry point.
+ */
+export async function checkPropertyLimit(ownerId: string): Promise<string | null> {
+  const plan = await getUserPlan(ownerId)
+  const [{ count }] = await db
+    .select({ count: sql<number>`count(*)::int` })
+    .from(properties)
+    .where(eq(properties.user_id, ownerId))
+  if (!checkLimit(plan, "maxProperties", count)) {
+    return "Plan limit reached. Upgrade to add more properties."
+  }
+  return null
+}
+
+/**
+ * Returns a user-facing error message if the owner is at their plan's tenant
+ * cap, otherwise null. Call before every tenant insert, on every entry point.
+ */
+export async function checkTenantLimit(ownerId: string): Promise<string | null> {
+  const plan = await getUserPlan(ownerId)
+  const [{ count }] = await db
+    .select({ count: sql<number>`count(*)::int` })
+    .from(tenants)
+    .where(eq(tenants.user_id, ownerId))
+  if (!checkLimit(plan, "maxTenants", count)) {
+    return "Plan limit reached. Upgrade to add more tenants."
+  }
+  return null
+}