Append 2026-04-12 session summary for billing, auth, onboarding, and dashboard work

SESSION_LOG.md

@@ -53,7 +53,7 @@ Dev container model:
 - Traefik dynamic file provider confirmed as correct routing approach — no plugin needed, no SRV records needed
 
 Agent review (zlh-agent commit 6019d0bc — 2026-03-15):
-- Catalog transition confirmed correct — ValidateRuntimeSelection gates all dev provisions
+- Catalog transition confirmed correct — ValidateRuntimeSelection gates all dev provisioning
 - Scripts unchanged — embedded script execution via bash stdin pipe, no 126 risk from runtime installs
 - devcontainer/common.go is clean and complete
 - node/verify.go has hardcoded /opt/zlh/runtime/node/bin/node — wrong path, pre-existing issue
@@ -75,3 +75,68 @@ Code-server routing:
   1. Assign code-server a port that won't conflict with Node (6000 taken)
   2. Add launch step to addon install script — install != start, binary must be daemonized after provisioning
 - Suggested launch: nohup /opt/zlh/services/code-server/bin/code-server --bind-addr 0.0.0.0:<port> --auth none /home/dev/workspace > /opt/zlh-agent/logs/code-server.log 2>&1 &
+
+---
+
+## 2026-04-12
+
+Goal: Close the billing loop, ship first-run onboarding, and refresh the dashboard home surface.
+
+Work completed:
+
+Infra / Billing path:
+- public billing hostname and reverse proxy path fixed at `billing.zerolaghub.com`
+- Caddy TLS issuance succeeded for `billing.zerolaghub.com` and `portal.zerolaghub.com`
+- Stripe webhook delivery validated live against the public billing endpoint
+- Prisma verified local billing state persistence after webhook delivery
+
+API:
+- billing webhook now persists live billing state
+  - `subscriptionStatus`
+  - `plan`
+  - `currentPeriodEnd`
+  - `lastInvoicePaidAt`
+  - `billingSyncedAt`
+- direct upgrade flow implemented via `POST /api/billing/upgrade`
+- period-end scheduled downgrade flow implemented via `POST /api/billing/downgrade`
+- scheduled downgrade persistence added:
+  - `scheduledPlan`
+  - `scheduledPlanEffectiveAt`
+- centralized plan limits added and enforced in `POST /api/instances`
+  - basic: 1 game / 1 dev
+  - pro: 3 game / 3 dev
+  - admin exempt
+- password reset API flow implemented:
+  - `POST /api/auth/password-reset/request`
+  - `POST /api/auth/password-reset/confirm`
+
+Portal:
+- billing page aligned to live API billing state
+- honest Stripe portal section reduced to one real portal entry point
+- direct in-app Basic → Pro upgrade flow wired
+- direct in-app Pro → Basic scheduled downgrade flow wired
+- quota/plan-limit messaging added to server create flow with billing upgrade guidance
+- forgot-password and reset-password pages added and linked from login
+- first-login onboarding shipped on dashboard:
+  - welcome modal
+  - quick tour
+  - full tour
+  - skip / completion persistence via localStorage
+- dashboard refreshed from mini-listing to home surface:
+  - duplicate resource overview removed
+  - spotlight server card/carousel added
+  - primary actions + notices retained
+
+Outcome:
+- billing loop is now functional end-to-end
+- auth reset flow is present end-to-end
+- onboarding is now in-product
+- dashboard now feels like a dashboard instead of a duplicate servers page
+
+Confirmed remaining follow-ups:
+- game server world backup / restore
+- email notifications
+- Open IDE production-path confirmation
+- SSH config snippet for power users
+- service discovery cleanup
+- upload, stress, and provisioning validation