Block a user
Add automated tests and CI gates for domain, DB, and app flows
Harden API and runtime security controls
Build the MVP admin surfaces: web admin and Telegram operations
Build the public web product surfaces for the MVP
Replace the simulated image provider and wire the real storage pipeline
Implement payment reconciliation, callbacks, and invoice expiry/cancel flows
Decouple generation job polling from key-balance polling
Make worker claims and provider attempts crash-safe
Scope generation idempotency keys per user instead of globally
Stop leaking password-reset tokens through email/logging fallbacks
Fail over on out-of-funds keys instead of failing the user request immediately
Stop leaking exact quota numbers from GET /api/account
Enforce subscription period end and lifecycle transitions
Make invoice payment activation idempotent and auditable
