🔒 (app): limit api_key auth to Zapier /z routes

🔒 (accounts): gate feedback summary email preview behind sign-in and ownership/admin check

↩️ (purchase): restore high-price donation percentage tiers

Use lower suggested percentages for high-value baskets so the default checkout donation stays proportionate.

🐛 (event_feedbacks.rb): redirect to a specific event feedback page after delete instead of using redirect back to avoid potential issues with the back navigation
💄 (event_feedback.erb): replace the "Delete" text with an "x" icon to better match the UI style

✨ (event_feedbacks): allow admins to permanently delete event feedback

🎨 (event_feedback.erb): add admin-only hard delete action to feedback view

🐛 (event_feedbacks): use unscoped to find feedback records for hard delete (works around default scope)

✨ (stripe_subscriptions_sync.rb): expand kept statuses to include past_due/unpaid
📝 (stripe_subscriptions_sync.rb): add explicit clear-subscription statuses (canceled, incomplete_expired)
♻️ (stripe_subscriptions_sync.rb): rename active?/ACTIVE_STATUSES to keep_subscription?/KEEP_SUBSCRIPTION_STATUSES for clarity
🐛 (stripe_subscriptions_sync.rb): only clear local subscription id on explicitly "clear" statuses to avoid races
♻️ (stripe_subscriptions_sync.rb): fetch all subscriptions in reconcile and filter in-app so we capture new statuses

⚡ Scope event match phrase search

Search event match phrases within the relevant future organisation scope so event pages avoid broad Atlas Search scans.

♻️ Refactor Searchable range filter logic into smaller methods

Extract RANGE_OPERATORS constant and split range handling into dedicated helpers (atlas_search_range_filter, vector_search_leaf_filter, vector_search_range_filter, search_range_values) to reduce duplication and clarify responsibilities between Atlas and vector search paths. Also pushes unsupported hash operators into remaining_selector instead of silently building an equality filter, keeping the search semantics consistent across branches.

🎨 Use unquoted symbol literals in test file

Replace :"$search" and :"$match" with :$search and :$match since Ruby symbols containing $ don't require string quoting.

Merge pull request #205 from symbiota-coop/cursor/push-search-filters-df2d

Push supported event filters into Atlas Search

✨ enable guest donations without requiring an account

Allow donations from users without an account by making the account association optional on AccountContribution. The /accounts/pay endpoint now accepts an optional account_id parameter, and the donate view displays the payment form for both authenticated users and guests. Notification emails and body text are adjusted to handle guest contributions appropriately.

Fix searchable filter test teardown

Co-authored-by: Stephen Reid

Push supported event filters into Atlas Search

Co-authored-by: Stephen Reid

💄 (build.erb): remove mb-sm-4 class from star rating description to improve responsive layout

💄 Redesign event feedback form with card layout and improved star rating UI

• Wrap feedback form in card with header for clearer visual hierarchy
• Add dedicated rating panel with description explaining impact on host reputation
• Improve star rating interaction using data attributes and CSS classes
• Add accessibility attributes (role, aria-label) to star rating widget
• Group privacy options in a distinct section with separator
• Rename submit button to "Submit feedback" for clarity

✨ (controllers/models): add payment intent metadata to Stripe checkout sessions and payments

The metadata passed to Stripe includes the contribution type, source, and relevant IDs (account, event, event_boost, organisation), enabling better tracking and reconciliation of payments in Stripe and downstream systems.

💄 (stats): improve layout of charts and contributions pages

• Wrap charts in responsive grid (col-lg-6) for better display
• Change contributions cards from col-sm-6 to col-sm-4 for 3-per-row layout

✨ Add dedicated contributions stats page with breakdown chart

Move contributions from the charts page to its own /stats/contributions view with a stacked bar chart showing breakdown by Stripe source, projection for the current month, and a 3-month average trend line. The calculator now stores breakdown data alongside monthly totals.

Add 30-minute timeout to daily bug review workflows.

Prevents Claude and Cursor bug review jobs from running indefinitely.

Keep Stripe monthly subscriptions in sync with account records.

Add reconciliation against active Stripe subscriptions and handle subscription.updated webhooks so canceled subs clear stale Mongo IDs.