Deploy-readiness and security review (no code changes)

[macaddy2]

Defensive review of whether Fixars is ready to deploy in its current form.

Verdict: not ready to deploy as a public product. The root app is a high-fidelity mock (forced-off Supabase, localStorage auth and wallet) and GitHub Pages already publishes that prototype on every main push.

This PR adds only docs/deploy-readiness-security-review.md. No application code, exploits, or secret values.

Highlights:

• Blockers: fake investment UI, Pages already live, mock auth, RLS/payment stubs unsafe if Supabase is flipped on
• High: Pages vs Railway vs waitlist surface conflict, browser Gemini key pattern, waitlist Google Form PII, FTP publish
• Recommended public posture: waitlist + static product/group sites only; keep the super-app private until auth, persistence, and money paths are real

Full findings, hardening suggestions, and open questions are in the report.