add Phase 2: supplier dashboard, business plan PDF, Paddle.js checkout, admin tools

Migrate all checkouts to Paddle.js overlay (no redirect), move Paddle price
IDs from env vars to DB table, add 4-tab supplier dashboard (overview, leads,
listing, boosts), business plan PDF export with WeasyPrint, enhanced supplier
landing page with live stats, admin supplier management + feedback widget.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,118 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added — Phase 2: Scale the Marketplace — Supplier Dashboard + Business Plan PDF
+
+- **Paddle.js overlay checkout** — migrated all checkout flows (billing,
+  supplier signup, business plan) from server-side Paddle transaction creation +
+  redirect to client-side `Paddle.Checkout.open()` overlay; `PADDLE_CLIENT_TOKEN`
+  config; Paddle.js script in `base.html` with sandbox/production toggle
+- **Paddle products in DB** — new `paddle_products` table replaces 16
+  `PADDLE_PRICE_*` env vars; `get_paddle_price(key)` and
+  `get_all_paddle_prices()` async helpers in `core.py`; `setup_paddle.py`
+  rewritten to write product/price IDs directly to database
+- **Migration 0008** — `paddle_products`, `business_plan_exports`, `feedback`
+  tables; `logo_file` and `tagline` columns on `suppliers`
+- **Umami analytics** — tracking script in `base.html`; config vars
+  `UMAMI_API_URL`, `UMAMI_API_TOKEN`, `UMAMI_WEBSITE_ID`; directory click
+  tracking redirect routes (`/<slug>/website`, `/<slug>/quote`)
+- **Supplier dashboard** (`/suppliers/dashboard`) — tab-based HTMX dashboard
+  with sidebar nav (Overview, Lead Feed, My Listing, Boost & Upsells); each
+  tab loads via `hx-get` with `hx-push-url` for deep-linking
+  - **Overview tab** — 4 KPI stat cards (profile views, leads unlocked, credit
+    balance, directory rank), new leads alert banner, recent activity feed
+  - **Lead feed tab** — refactored `_get_lead_feed_data()` shared function
+    with bidder count; heat/country/timeline filter pills; region matching
+    badges; "No other suppliers yet — be first!" messaging
+  - **My Listing tab** — preview card + inline edit form (company info,
+    categories, service area, logo upload); `POST /suppliers/dashboard/listing`
+    saves changes
+  - **Boost & Upsells tab** — current plan, active boosts, available boosts
+    with `Paddle.Checkout.open()` purchase buttons, credit packs grid, summary
+    sidebar with visibility multiplier
+- **Business plan PDF export** — `businessplan.py` with WeasyPrint PDF engine;
+  `plan.html` + `plan.css` A4 templates (executive summary, CAPEX, OPEX,
+  revenue model, 5-year P&L, 12-month cash flow, sensitivity, key metrics);
+  bilingual EN/DE; `generate_business_plan` worker task
+- **Business plan routes** — `GET /planner/export` (options page with scenario
+  picker + Paddle checkout), `POST /planner/export/checkout`, `GET
+  /planner/export/success`, `GET /planner/export/<id>` (download); export CTA
+  in planner sidebar
+- **Supplier landing page enhanced** — live stats from DB (business plans
+  created, avg project value, suppliers listed, monthly leads); real anonymized
+  lead preview cards (fallback to example data); credit explainer (hot=35,
+  warm=20, cool=8); "Most Popular" badge on Growth plan; expanded FAQ (8
+  questions including credits, countries, cancellation); social proof section
+- **Admin supplier management** — `GET /admin/suppliers` with tier/country/name
+  filters (HTMX search), `GET /admin/suppliers/<id>` detail with profile info,
+  credit balance + ledger, active boosts, lead forward history; `POST
+  /admin/suppliers/<id>/credits` manual credit adjustment; `POST
+  /admin/suppliers/<id>/tier` manual tier change; supplier stats on admin
+  dashboard (claimed, growth, pro, credits spent, leads forwarded)
+- **Feedback widget** — compact "Feedback" button in navbar opens HTMX popover
+  with textarea; `POST /feedback` rate-limited (5/hr per IP), inserts into
+  `feedback` table; `GET /admin/feedback` paginated admin view with user email
+  + page URL
+
+### Added — Phase 1: Lead Operations + Builder Directory Monetization
+
+- **SDK migration** — replaced raw httpx calls with official `paddle-python-sdk`
+  and `resend` SDKs for type safety, built-in webhook verification, and cleaner
+  code; `send_email()` now accepts `from_addr` parameter; all Paddle API calls
+  use SDK client
+- **EMAIL_ADDRESSES dict** — hardcoded `transactional`, `leads`, and `nurture`
+  from-addresses sharing the `notification.padelnomics.io` Resend domain
+- **Paddle product setup script** — `scripts/setup_paddle.py` creates all 14
+  products/prices programmatically via SDK; outputs `.env` snippet for CI
+- **Claude Code skills** — `.claude/skills/paddle-integration/SKILL.md` and
+  `.claude/skills/resend-emails/SKILL.md` for consistent SDK usage patterns
+- **Migration 0007** — `credit_ledger`, `lead_forwards`, `supplier_boosts`
+  tables; 12 new columns on `suppliers` (profile, credits); `credit_cost` and
+  `unlock_count` on `lead_requests`
+- **Credit system** (`credits.py`) — `get_balance`, `add_credits`,
+  `spend_credits`, `unlock_lead`, `compute_credit_cost`, `monthly_credit_refill`,
+  `get_ledger`; `InsufficientCredits` exception; heat-based pricing (hot=35,
+  warm=20, cool=8 credits); `refill_monthly_credits` worker task + scheduler
+- **Admin lead management** — `GET /admin/leads` with status/heat/country
+  filters (HTMX search), `GET /admin/leads/<id>` detail with project brief +
+  forward history, `POST /admin/leads/<id>/status` update, `POST
+  /admin/leads/<id>/forward` manual forward (no credit cost); lead funnel stats
+  on admin dashboard (planner users → leads → verified → unlocked)
+- **Lead forwarding emails** — `send_lead_forward_email` worker task sends full
+  project brief + contact details to supplier; `send_lead_matched_notification`
+  notifies entrepreneur when a supplier unlocks their lead
+- **Credit cost computed on submission** — `credit_cost` set from heat score
+  both on verified-user submission and on email verification
+- **Supplier signup wizard** (`/suppliers/signup`) — 4-step HTMX wizard: plan
+  selection (Growth €149/mo, Pro €399/mo), boost add-ons (logo, highlight,
+  verified, newsletter), credit packs (25-250), account details + order summary;
+  builds multi-item Paddle transaction; `_accumulated` hidden JSON pattern
+- **Supplier claim flow** — `GET /suppliers/claim/<slug>` verifies unclaimed
+  and redirects to signup with pre-fill
+- **Webhook handlers** — `subscription.activated` with `supplier_*` plan creates
+  supplier record with tier, credits, and boosts; `transaction.completed`
+  handles credit pack purchases and sticky boost purchases with expiry
+- **Supplier profile page** (`/directory/<slug>`) — public profile with logo,
+  verified badge, description, service categories as pills, service area, years
+  in business, project count, website; "Request Quote" and "Claim This Listing"
+  CTAs
+- **Directory card links** — all directory cards now link to supplier profile
+  pages; paid-tier cards show "Request Quote" mini-CTA
+- **Supplier lead feed** (`/suppliers/leads`) — requires login + paid supplier
+  tier; shows anonymized lead cards with heat badge, facility type, courts,
+  country, timeline, budget range, credit cost, unlock count; `POST
+  /suppliers/leads/<id>/unlock` spends credits, creates lead_forward, sends
+  emails, returns full-details card via HTMX swap
+- **Email nurture via Resend Audiences** — on first scenario save, user is added
+  to "Planner Users" audience (triggers 3-email automation); on quote submission,
+  user is removed from audience (stops nurture)
+- **PADDLE_PRICES expanded** — 13 new price keys for supplier plans, boosts,
+  credit packs; `PADDLE_ENVIRONMENT` config for sandbox/production switching
+
+### Changed
+- Supplier marketing page CTAs link to `/suppliers/signup` instead of mailto
+- `httpx` removed from direct dependencies (transitive via paddle SDK)
+
 ### Added
 - **Double opt-in email verification for quote requests** — guest quote
   submissions now require email verification before the lead goes live;