Activate reviewer invitation callback and account controls on production #437

The current Supabase invitation email still displays http://localhost:3000. PR #436 prepares the reviewer website callback, shared account setup, account limits, optional authenticator default, and membership-only removal in source. Live invitations will use the correct destination only after the hosted settings and matching code are deployed.

Activation checklist

• Review and merge Fix reviewer invitations and account controls #436 through the normal PR process; deploy the matching API and reviewer site revision. Do not merge solely to change the email template.
• Apply and verify migrations 0131–0134 in order, and run the schema health check before enabling the corresponding API/Edge revision. Mark migration ledger entries only after live application is verified.
• In the API environment, set EDITORIAL_INVITE_REDIRECT_URL=https://coding-moves-one-concept-review.netlify.app/auth/callback and ensure ALLOWED_ORIGINS contains the exact reviewer-site origin.
• In Supabase Auth URL Configuration, allow the exact /auth/callback URL. Keep the Site URL and existing learner signup/recovery redirects on their working destinations.
• Install the Invite user subject and HTML from backend/email-templates/invite-reviewer.html in the correct Supabase project. Check the configured sender can deliver to intended recipients; keep password-changed security notification enabled if the owner expects a separate password-change notice.
• Invite a new test reviewer from the website's Reviewers page. Confirm the email contains no localhost URL, the verification button reaches the dedicated review-site setup page, password confirmation succeeds, and the same credentials sign in to both the learning app and review site after name approval. Verify the Auth user has one learner profile, not two identities.
• Retry an invitation for an unconfirmed Auth identity and verify a fresh usable email arrives. A confirmed learner should instead keep their existing password and sign in directly after owner enrollment.
• Decide whether a confirmed learner should receive a separate reviewer-access notification. Supabase's Invite user email is only sent to new or unconfirmed Auth users; the current confirmed-learner path grants membership without an email. Until a notification flow exists, the owner must tell that learner to use the review-site sign-in link.
• Request Forgot password from the review site, open the recovery email, set a new password, and sign in on both clients. Check expired or incomplete links safely return to sign-in without leaving credentials in the URL.
• Confirm new reviewers start with authenticator requirement off, can enable it in Settings, and the owner-inclusive 10-active-reviewer limit rejects an eleventh.
• Permanently remove a test reviewer through Reviewers. Confirm editorial access and open assignments are removed while their learning account and historical review evidence remain.
• Use Request changes on a pending revision with generation enabled. Verify the next scheduled worker run produces a private correction draft, then a human approves/publishes it. A plain Add comment currently records feedback only. Check queue-disabled, capacity-full, and retry states.

Additional requested product work

• Add a bounded automatic top-up for the global private reviewer draft queue: when fewer than 10 unpublished drafts remain, prepare only the shortfall to reach 10. Use existing reviewed curriculum/backlog titles; do not invent unlimited topics or publish drafts automatically. Count in-flight generation to prevent overlapping runs from exceeding ten. Respect generation switches, provider daily/topic caps, reviewer capacity, retries, and the owner's stop controls. Implement and test equivalent behavior in whichever Railway/Supabase scheduled worker is active at rollout. Current future refill is reader-demand driven and disabled in production, so this is not live yet.
• Decide whether Add comment should ever request AI changes. Today only the explicit Request changes decision queues correction; allowing arbitrary comments to trigger paid AI or change published lessons needs an eligibility rule. Human approval/publication must remain the final gate.

The public home page and /auth/callback returned HTTP 200 on 2026-10-22; this only confirms routing. No real invitation, password change, production setting, or live worker was changed by the source PR. Do not delete Supabase Auth users to remove reviewer access.