POST /api/v2/files returns 403 for cross-origin requests; preflight OPTIONS never reaches the handler.

Consolidate billing, profile, and notification preferences into a single tabbed layout using the new design tokens.

Implement a sliding-window limiter (100 req/min per key) with proper Retry-After headers on 429 responses.

Cover happy path, declined card, and coupon-code scenarios using Playwright against the staging environment.

Add OpenAPI 3.1 schemas for all event types and publish the spec to the developer portal.