🔒️ (accounts.rb): add token validation before confirming email address

♻️ (helpers): refactor authentication to separate API key auth from session-based auth

Previously, API key sign-in would set the session, mixing authentication methods. Now API key authentication uses a separate instance variable, keeping authentication methods distinct and preventing potential conflicts between session and API key based requests.

🐛 Remove timezone suffix from order notification message

🔒 (models/account.rb): replace custom HMAC with ActiveSupport::MessageVerifier for feedback tokens

Improve token security by using Rails' built-in secure MessageVerifier while maintaining backward compatibility with legacy tokens. Add TODO to remove legacy support once all tokens are migrated.

🔒 (map): encrypt map IDs to prevent ID enumeration and hide internal model identifiers

🔒️ (pmails.rb): fix IDOR vulnerability by validating organisation access via @_organisation instead of direct lookup

📝 (pre-commit): remove "exhaustively" from MongoDB indexes comment

🐛 Fix setting empty password when updating account

The original code would set an empty password if params[:password] was an empty string. Now uses .present? to only set password when it has content.

🔒️ (organisations_pay.rb): add organisation admin authorization checks to Stripe endpoints

🔒️ (accounts.rb): use delete to remove password from params before mass assignment

🔒️ (models/account.rb): add password and other sensitive fields to protected attributes to prevent mass assignment vulnerabilities
✨ (controllers/accounts.rb): add direct password update support for account settings changes

📝 (terms.md): update terms and conditions with age requirement, improved liability clauses, and termination policy

🔒️ Remove insecure account lookup via params[:t] parameter

📝 (docs): add affiliate credits documentation explaining referral system
🛂 (credit_balance): restrict credit adjustment controls to organisation admins only

📝 (docs): fix typos, update external resources and contact email across multiple documentation files

♻️ Refactor moon phase calculation and format HTML file

• Update getMoonPhase() with more precise lunar calculations matching lib/almanac.rb
• Use accurate synodic month constant (29.530588853) and reference new moon time
• Adjust phase boundaries to align with backend implementation
• Reformat HTML with consistent indentation and structure

♻️ (event_atproto.rb): remove valid array from verify_atproto_collection return value

Valid records are now tracked only for counting in summary, reducing response payload size.

🐛 (lib/currencies.rb): add trailing space to currency symbol for EVM currencies to properly separate symbol from amount

🐛 Fix polymorphic association ID field type from text to id

♻️ Refactor set_counts from class method to instance method in Organisation model
✨ Add hourly task to update paid up status for organisations with recent orders
🧱 Move paid up status and stripe topup logic to rake task for better separation of concerns