Pre-launch checklist

All PRD user stories pass on the production URL
Sign-up, sign-in, sign-out and password reset work
Stripe in live mode; test purchase, refund and cancel
Stripe webhook verified and updating the database
Row-level security on for every Supabase table
No secrets in the repo; all keys in environment variables
AI spend limits set in the AI Gateway or provider console
Privacy policy, terms of service, cookie notice
Analytics and error monitoring installed
Mobile layout checked on a real phone
Backups on for the database