Commerce backend: accounts, MFA, transactional mail, and Polar billing at 100% test coverage.
- Session-token auth spine with refresh rotation, canonical email, and brute-force lockout.
- Sealed-at-rest TOTP MFA with enforced second factor and recovery codes.
- Full transactional-mail pipeline: outbox queue, delivery policy, drain worker, suppression and consent.
- Federation-wide subscription tiers with server-side entitlement enforcement and Polar webhooks.