Prepare community web and CLI for reviewed production rollout

[TeoSlayer]

Prepare the community web app and authenticated CLI for a reviewed production rollout. Production has been restored to its original v0.2.5 binary/config/public routing; the portal and automatic engine updates are disabled. Do not merge, publish a release, or deploy without a new explicit instruction. The cancelled manual build did not deploy these changes.

This PR now targets main and consolidates all pending work from #56 and #57 with the limits and quality changes. The earlier community/CLI implementation from merged #55 is part of the complete candidate tree. No additional main-branch changes have been merged.

• Revert the draft ranking changes from index: make the BM25 MaxScore bound authority-aware (fixes k-dependent ranking) #54 exactly to their pre-PR state. This still needs normal owner review; Revert draft BM25 ranking changes from PR #54 #56 remains a draft reference.
• Route public visitors to signup/login and hide operational counters/routes. Web and CLI support Search, Answer, Research, saved requests, interests, URL/CSV contributions and verified local text/metadata/embedding artifacts.
• Persist hard caps shared by sessions and public aliases: Search 60/minute, Answer 20/minute, Research 3/10 minutes. Members have 60 shared free requests/minute; extra requests cost one credit within those caps. Guests share one request/minute, with Answer one/5 minutes and Research one/30 minutes. Backend failures release mode reservations and refund guest allowances/credits. Flags and /api/limits keep the UI consistent with policy.
• Stop obvious parked/placeholder pages, bot/login/error pages and extreme repetitive filler before model calls. Extend strict moderation to spam, link farms, SEO doorway pages and incoherent content. Preserve useful code, non-English content and educational/medical research. Only validated, newly indexed content earns credits; duplicates earn none. Stripe one-time purchases are implemented and remain disabled until configured.

Public /search, /answer and /research now route through portal quotas. They accept GET with q; existing public POST, streaming and advanced native parameter users require migration. Loopback engine access remains available to operators. Check these consumers before approval.

Production rollout and rollback handoff covers signed artifacts, baseline backups, HNSW readiness, moderation and guarded ingestion gates, the old standalone service override, account backups, browser/CLI checks, and rollback. A portal-only deployment on v0.2.5 cannot activate contributions: the reviewed engine must supply the guarded endpoints. No fallback to unguarded indexing is permitted.

Stripe adds one prepaid pack: $5 for 50,000 credits, or $0.10 per 1,000 extra requests. One credit still pays for an extra Search, Answer or Research request; existing hard caps remain. This is one tenth of Parallel's cheapest listed Search price and less than one tenth of Exa Search, checked 2026-09-16. This compares posted prices, not result quality or feature parity.

Checkout is card-only, one-time and hosted by Stripe. No subscriptions, auto top-ups or pre-created Price IDs. Activation requires STRIPE_SECRET_KEY plus STRIPE_WEBHOOK_SECRET. Signed paid-session webhooks validate the local order and grant credits once; refunds revoke purchased credits proportionally. The browser return URL cannot grant credits. See Stripe setup and credentialed test checklist. No real keys were used and no charges were made.

Validation: community and CLI race suites passed; Stripe tests cover configuration/auth/CSRF, server-owned prices, retry idempotency, strict webhook signatures, unpaid/mismatched sessions, concurrent and duplicate fulfillment, restart persistence, transaction rollback and partial/full/out-of-order refunds. Vet and JavaScript syntax passed; browser verified the signed-in $5 purchase button, pack size, cap disclosure, and disabled state without configuration. Test/live checkout retries are isolated and have a regression test; Stripe test mode must use an isolated account database. Earlier full PR CI and local crawl/serve smoke passed before Stripe; Full CI passed for final commit 5cf4822: formatting, full vet, Linux ARM64 compilation and the complete race/coverage suite. Snyk passed; merge state is clean and auto-merge remains disabled. A real Stripe test-mode Checkout and webhook delivery still need credentials before live activation.

No deployment, release or merge is authorized. Production remains restored to the original v0.2.5 setup with the portal and updater disabled.

[codecov]

Codecov Report

❌ Patch coverage is 71.64179% with 95 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/community/payments.go	71.51%	30 Missing and 19 partials ⚠️
internal/community/limits.go	73.41%	12 Missing and 9 partials ⚠️
internal/community/server.go	69.56%	3 Missing and 4 partials ⚠️
cmd/cosift/community.go	14.28%	6 Missing ⚠️
cmd/cosift/community_moderation.go	0.00%	5 Missing and 1 partial ⚠️
internal/index/pebble_bm25.go	62.50%	2 Missing and 1 partial ⚠️
internal/community/credits.go	60.00%	1 Missing and 1 partial ⚠️
internal/community/guest.go	66.66%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!