chore: sync in-progress work across marketing, admin, API and tests

Snapshot of uncommitted work that had accumulated in the tree alongside
the Turnstile changes:

- marketing pages, SEO helpers (lib/seo.ts, lib/marketing/) and
  structured data
- admin billing actions and a per-user portfolio view, plus an admin
  error boundary
- rate limiting (lib/rate-limit.ts) applied across the /api/v1 surface
- CSP and proxy adjustments, accounting/webhook lib updates
- Playwright config and an e2e/unit test suite
- next bumped to ^16.3.4 with the lockfile regenerated
- generated AGENTS.md / CLAUDE.md

Authored by other sessions working in this tree; committed here so the
Turnstile work could be pushed without leaving the tree dirty.
Typecheck passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

playwright.config.ts

@@ -0,0 +1,52 @@
+import { defineConfig, devices } from "@playwright/test"
+
+/**
+ * Two projects with very different requirements:
+ *
+ *   unit — pure logic (rate limiting, SSRF guard, upload validation, API-key
+ *          hashing, crypto, plan limits). No browser, no database, no network.
+ *          Runs anywhere, including CI on a bare container, in about a second.
+ *
+ *   e2e  — real browser against a running app. Needs DATABASE_URL to point at a
+ *          migrated Postgres, so it is NOT part of the default run. Enable with
+ *          `npm run test:e2e` once a database is available.
+ *
+ * `npm test` runs the unit project only, so a missing database can never make
+ * the default test command fail for the wrong reason.
+ */
+export default defineConfig({
+  testDir: "./tests",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  reporter: process.env.CI ? [["github"], ["list"]] : [["list"]],
+
+  projects: [
+    {
+      name: "unit",
+      testDir: "./tests/unit",
+      use: {},
+    },
+    {
+      name: "e2e",
+      testDir: "./tests/e2e",
+      use: {
+        ...devices["Desktop Chrome"],
+        baseURL: process.env.E2E_BASE_URL ?? "http://127.0.0.1:3000",
+        trace: "on-first-retry",
+      },
+    },
+  ],
+
+  // Only started for the e2e project; `npm test` (unit) never boots the app.
+  ...(process.env.E2E === "1"
+    ? {
+        webServer: {
+          command: "npm run start",
+          url: process.env.E2E_BASE_URL ?? "http://127.0.0.1:3000",
+          reuseExistingServer: !process.env.CI,
+          timeout: 120_000,
+        },
+      }
+    : {}),
+})