What is inside

The tree

config/index.js       every setting and the plan definitions
lib/db.js             Postgres pool, query helpers, transactions, migrate
lib/schema.sql        the whole schema, idempotent
lib/auth.js           passwords, sessions, tokens, route guards
lib/billing.js        payment API client, webhook signatures, license keys
lib/mail.js           SMTP and the message templates
lib/http.js           cookies, CSRF, rate limiting
lib/flash.js          redirect messages, by code
routes/               public, auth, dashboard, billing, webhooks
views/                layout.js is the shell, pages.js is the pages
public/styles.css     one stylesheet, light and dark
scripts/              migrate, check, smoke, mail:test

What the code looks like

This is the actual webhook handler, unedited. It is representative: short, commented where it matters, nothing clever.

// routes/webhooks.js — the only place a plan ever changes.
const valid = ls.verifyWebhook(raw, req.get('x-signature'));
if (!valid) return res.status(401).send('bad signature');

// Providers retry any non-2xx, so the same event WILL arrive twice.
// The primary key on webhook_events is what makes the second one a no-op.
const inserted = await db.one(
  `insert into webhook_events (id, name, payload) values ($1, $2, $3)
    on conflict (id) do nothing returning id`,
  [eventId, eventName, payload]
);
if (!inserted) return res.status(200).send('duplicate');