- Next API routes: /api/register + /api/checkout (Stripe session) + /api/stripe-webhook
(signature-verified; fulfils through be-crm), ported from the landing's serverless
functions. Shared founder lead validation in src/lib/founder/lead.ts.
- /api/founder/lookup + /api/founder/session proxy be-crm's public endpoints.
- /thanks polls session_id → founder token → redirects to /portal/register?ft=<token>;
falls back to the emailed link if the webhook is briefly delayed.
- register-flow: reads ?ft=, validates + prefills (email locked, name, phone) from the
paid founder record, passes founderToken to crm.account.register (claims token +
provisions owner). Open registration is now blocked — only a paid founder (ft) or a
team invitee may register; everyone else sees a 'Founder access required' gate.
tanweer919