[baba-dev]

ClubKeep onboarding 503 fix + public safe demo (19 feature areas)

Exact validated SHA: 23a233e1d8269521a28edcb2b49d93a5f8fa9322 — CI #43589060034: all three jobs SUCCESS.

Root cause and fix

On password-only production, optional Google/magic link/passkey features were disabled; resolveAuthConfig() also disabled its auth limiter, making all protected club mutations return HTTP 503 "Onboarding is unavailable". Protected club POST now gets the isolated ClubKeep security limiter whenever available. Explicit AUTH_RATE_LIMIT_REDIS_URL wins; password-only mode falls back to the existing required ClubKeep-specific REDIS_URL; never MenuMinute Redis 6381/6382. Unavailable Redis still returns 503, not a fail-open permission bypass.

Full demo access

• Public /demo no-auth interactive fictional product showcase, 19 deep-linked views across owner, manager, staff, member, platform administrator. Covers all shipped B1–B6 features plus invitations, discovery and account-security UX; clearly labeled, resettable, zero network API mutations, server DB import prohibited by unit test. Safe for AI browsers and eventual visitor previews.
• Authenticated /home surfaces admin role, private platform directory moderation shortcut when PLATFORM_ADMIN, demo role switching, and explicit club-create CTA. Creating a club gives OWNER membership, separate MEMBER role remains enforced on real member-only routes.
• Offline, operator-only real isolated clubkeep_demo sandbox seed: 4 individually secured reviewer identities, 2 clubs; both main reviewer identities OWN one club and are explicitly linked MEMBER in the other. No production login secret, no backend public impersonation route. Seed refuses wrong database/non-demo origin/nonempty data.
• Operational runbook docs/DEMO_AND_ONBOARDING.md covers protected setup, scope, and acceptance.

Automated verification — all green on exact head

• x64 Prettier, ESLint, TypeScript, full unit tests, Redis/native services integration, standalone production build/startup, dependency audit.
• ARM64 Prisma, typecheck, route collision, Next.js 16 standalone build/startup.
• PostgreSQL 17 fresh/no-op/legacy migrations and drift, B1–B6 regressions, extra isolated clubkeep_demo_ci real seed and role/tenancy assertions.
• Public tour verified by source/test to avoid real API fetches, @/lib/prisma import and real auth module access.
• Temporary formatter removed.

Operator acceptance still necessary

• Verified owner signs in and successfully creates a real club with 201 response on live, after CI-gated deployment.
• Real anonymous public /demo walkthrough on 360/390/tablet/desktop and keyboard/contrast review.
• Independently provision, protect and verify authenticated demo subdomain if genuine API/browser testing is desired; not automatically created by merging.
• Confirm isolated Redis healthy, MenuMinute services unaffected and independent restore check.

This PR contains no live production data inserts or demo credentials; the isolated demo seeder is never executed by the production deploy helper.