fix(core): unbreak the outreach loop, then make it 57x faster at the data layer

.env.example

@@ -37,6 +37,21 @@ CORS_ORIGINS=*
 # Public base URL used in open/click tracking and unsubscribe links.
 TRACKING_DOMAIN=http://localhost:8000
 
+# --- API authentication (OPTIONAL but strongly recommended) -----------------
+# Unset => the REST API is OPEN. That is fine for a local clone-and-run, and
+# unsafe the moment the port is reachable from a LAN: with CORS_ORIGINS="*"
+# any website could delete your lead database or send cold email from your
+# mailbox.
+#
+# When set, every endpoint requires it:
+#   curl -H "X-API-Key: <key>" http://localhost:8000/api/v1/leads
+# The campaign tracker (/api/v1/campaigns/tracker/*) is exempt - it serves
+# the one-click unsubscribe and the click tracker, which are fetched by the
+# recipient's mail client.
+#
+# Generate with: openssl rand -hex 32
+API_KEY=
+
 # --- Scraper ----------------------------------------------------------------
 # Optional rotating egress proxies for directory scraping, comma-separated.
 # Recommended for sustained Google Maps volume (residential/Datacenter IPs

.github/workflows/ci.yml

@@ -62,3 +62,106 @@ jobs:
         run: |
           cd dashboard
           npm run build
+
+      - name: Type-check
+        run: |
+          cd dashboard
+          npm run typecheck
+
+  frontend-a11y:
+    name: Accessibility & Layout Stability
+    runs-on: ubuntu-latest
+    needs: frontend-check
+    env:
+      # The dashboard talks to the API through a same-origin Next.js rewrite,
+      # so the browser only ever calls the dashboard's own origin.
+      API_PROXY_URL: http://127.0.0.1:8000/api
+      CI: "true"
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+          cache: "npm"
+          cache-dependency-path: dashboard/package-lock.json
+
+      - name: Install Dashboard Dependencies
+        run: |
+          cd dashboard
+          npm ci
+
+      - name: Install Playwright browser
+        run: |
+          cd dashboard
+          npx playwright install --with-deps chromium
+
+      - name: Start the API
+        env:
+          DATABASE_URL: sqlite+aiosqlite:///./a11y-leadforge.db
+          USE_CELERY: "false"
+          PYTHONPATH: backend
+        run: |
+          cd backend
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          nohup python -m uvicorn app.main:app --host 127.0.0.1 --port 8000 > /tmp/lf-api.log 2>&1 &
+          for i in $(seq 1 60); do
+            if curl -sf http://127.0.0.1:8000/health > /dev/null; then echo "API up"; exit 0; fi
+            sleep 2
+          done
+          echo "API did not start"; cat /tmp/lf-api.log; exit 1
+
+      - name: Run the accessibility suite
+        run: |
+          cd dashboard
+          npx playwright test e2e/a11y.spec.ts --reporter=list
+
+  frontend-e2e:
+    name: End-to-End Suite
+    runs-on: ubuntu-latest
+    needs: frontend-check
+    env:
+      API_PROXY_URL: http://127.0.0.1:8000/api
+      CI: "true"
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+          cache: "npm"
+          cache-dependency-path: dashboard/package-lock.json
+
+      - name: Install Dashboard Dependencies
+        run: |
+          cd dashboard
+          npm ci
+
+      - name: Install Playwright browser
+        run: |
+          cd dashboard
+          npx playwright install --with-deps chromium
+
+      - name: Start the API
+        env:
+          DATABASE_URL: sqlite+aiosqlite:///./e2e-leadforge.db
+          USE_CELERY: "false"
+          PYTHONPATH: backend
+        run: |
+          cd backend
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          nohup python -m uvicorn app.main:app --host 127.0.0.1 --port 8000 > /tmp/lf-api.log 2>&1 &
+          for i in $(seq 1 60); do
+            if curl -sf http://127.0.0.1:8000/health > /dev/null; then echo "API up"; exit 0; fi
+            sleep 2
+          done
+          echo "API did not start"; cat /tmp/lf-api.log; exit 1
+
+      - name: Run the end-to-end suite
+        run: |
+          cd dashboard
+          npx playwright test --reporter=list

.gitignore

@@ -7,6 +7,9 @@ __pycache__/
 *.sqlite
 *.db
 leadforge.db
+# SQLite WAL sidecar files (created when journal_mode=WAL is enabled)
+*.db-wal
+*.db-shm
 *.log
 
 # Node & Next.js