feat: free open-source demo — remove paid subsystem

[vedantggwp]

Pivot to a free, open-source accessibility-scanner demo (no payments). Removes Stripe checkout/webhook, coupons, admin panel, paid report pages/routes, ReportCTA, admin-auth + stripe libs, and the stripe deps. Keeps scan → results → free revenue estimate + the MCP server. README rewritten as an OSS-demo doc; corrected the neuroedge.co.uk myth (never existed). next build verified green locally.

[devin-ai-integration]

Code Review — PR #4

Overall: Solid removal of the paid subsystem. The deletions are clean and the remaining scan→results→estimate flow builds green. A few residual issues:

Bugs / Leftover Code

1. app/components/ReportPreview.tsx still exists and references the old paid flow — This 482-line component renders a mock "fix kit" report preview with GSAP animations on the landing page Hero. While it's used purely as a visual demo (not functional), it still references concepts like "Get Your Fix Kit — £49" pricing semantics in its design and neuroedge.co.uk in the footer. Since the entire paid subsystem was removed, this component's messaging is now misleading. It should either be updated to reflect the free model or removed.

2. app/lib/constants.ts still contains stale references:

   • SITE.url is still "https://neuroedge.co.uk" (line 8) — the PR description explicitly says "neuroedge.co.uk never existed." This should be "https://app-beta-fawn.vercel.app".
   • CONTACT_EMAIL is "ved@neuroedge.co.uk" (line 44) — same domain that doesn't exist.

3. scan-service/src/server.ts — /api/generate-report route still exists (lines 57-148): The entire paid subsystem was removed from the frontend, but the scan-service still has the full generate-report endpoint including PDF generation, email sending via Resend, and Supabase reports table interactions. This is dead code that:

   • Still imports translateViolations, generatePdf, sendReport, notifyFailure
   • Still reads from/writes to the reports table
   • Could be triggered by anyone with the API key

   Recommendation: Remove the route or gate it behind a feature flag. At minimum, add a deprecation log.

4. scan-service/src/emailer.ts and scan-service/src/notify.ts — These files still exist and reference neuroedge.co.uk. They're only consumed by the dead /api/generate-report route but remain importable.

Edge Cases

5. Rate-limit key for /api/scan (app/api/scan/route.ts:11): The rate-limit key is just clientIp (no prefix), while all other routes use a prefix like estimate:${clientIp}. This means the scan rate-limit counter collides with any other route that might accidentally use a bare IP key. Should be scan:${clientIp} for consistency and safety.

Improvements

6. README still mentions "optional" LLM translation but the translator code path is only triggered by the now-dead /api/generate-report. The scan endpoint (/api/scan) never calls the translator. The README should clarify that LLM translation is legacy/unused in the current free flow.

7. package-lock.json diff is minimal (only removes stripe deps) — good, no unexpected dependency changes.