Phase 4 Stage 1: backend foundation (additive endpoints + schema)

Schema (idempotent migration):
- payment_sessions.is_free_trial -> is_first_session_discount (data copied)
- payment_sessions.mode TEXT NOT NULL DEFAULT 'chat' CHECK (chat|call)
- chat_sessions.topics TEXT[] for ESP picks (info-only)

New endpoints:
- GET /api/client/onboarding-state (drives verif sheet + S6 paywall gate)
- GET /api/client/chat-pricing (rewrite: chat+call groups + first-session
  discount block, per-customer eligibility)
- GET /api/shared/auth-providers (env-probed; replaces ENABLE_SOCIAL_AUTH
  build flag — frontend cutover lands in stage 2)
- GET /api/client/support-handles (Tanya Admin handles, CC-config-driven)

session_warning WS event fires once at 180s remaining.

app_config seeds (mock pricing tiers, first-session discount, support
handles, payment method order, end-session 2-step toggle).

CC SettingsPage: 3 new sections (first-session discount, pricing tiers
JSON editors, support handles).

15/15 Vitest passing. chat_sessions.is_free_trial also renamed for
consistency (plan only specified payment_sessions; pairing.service.js
read both).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/routes/internal/config.routes.js

@@ -14,6 +14,9 @@ import {
   getReturningChatConfirmationTimeoutSeconds, setReturningChatConfirmationTimeoutSeconds,
   getExtensionDefaultActionOnTimeout, setExtensionDefaultActionOnTimeout,
   getPairingBlastTimeoutSeconds, setPairingBlastTimeoutSeconds,
+  getFirstSessionDiscountConfig, setFirstSessionDiscountConfig,
+  getSupportHandles, setSupportHandles,
+  getPricingTierGroups, setPricingTierGroup,
 } from '../../services/config.service.js'
 
 const attachCcUser = async (request, reply) => {
@@ -284,4 +287,104 @@ export const internalConfigRoutes = async (app) => {
     await publishConfigInvalidate('pairing_blast_timeout_seconds')
     return reply.send({ success: true, data: config })
   })
+
+  // --- Phase 4: First-session discount ---
+  app.get('/first-session-discount', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (_req, reply) => {
+    return reply.send({ success: true, data: await getFirstSessionDiscountConfig() })
+  })
+
+  app.patch('/first-session-discount', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'update')],
+  }, async (request, reply) => {
+    const { enabled, actual_price_idr, gimmick_price_idr, duration_minutes, modes } = request.body ?? {}
+    const patch = {}
+    if (enabled !== undefined) {
+      if (typeof enabled !== 'boolean') {
+        return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'enabled must be a boolean' } })
+      }
+      patch.enabled = enabled
+    }
+    for (const [field, value] of [
+      ['actual_price_idr', actual_price_idr],
+      ['gimmick_price_idr', gimmick_price_idr],
+      ['duration_minutes', duration_minutes],
+    ]) {
+      if (value !== undefined) {
+        if (typeof value !== 'number' || value < 0 || !Number.isFinite(value)) {
+          return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: `${field} must be a non-negative number` } })
+        }
+        patch[field] = Math.round(value)
+      }
+    }
+    if (modes !== undefined) {
+      if (!Array.isArray(modes) || modes.some((m) => m !== 'chat' && m !== 'call')) {
+        return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'modes must be an array of "chat" | "call"' } })
+      }
+      patch.modes = modes
+    }
+    const config = await setFirstSessionDiscountConfig(patch)
+    await publishConfigInvalidate('first_session_discount')
+    return reply.send({ success: true, data: config })
+  })
+
+  // --- Phase 4: Pricing tier groups (chat / call) ---
+  app.get('/pricing-tiers', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (_req, reply) => {
+    return reply.send({ success: true, data: await getPricingTierGroups() })
+  })
+
+  app.patch('/pricing-tiers/:mode', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'update')],
+  }, async (request, reply) => {
+    const mode = request.params.mode
+    if (mode !== 'chat' && mode !== 'call') {
+      return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'mode must be chat or call' } })
+    }
+    const { tiers } = request.body ?? {}
+    if (!Array.isArray(tiers) || tiers.length === 0) {
+      return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'tiers must be a non-empty array' } })
+    }
+    for (const t of tiers) {
+      if (
+        typeof t.id !== 'string'
+        || typeof t.minutes !== 'number' || t.minutes <= 0
+        || typeof t.price_idr !== 'number' || t.price_idr < 0
+      ) {
+        return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'each tier needs id (string), minutes (number > 0), price_idr (number >= 0)' } })
+      }
+    }
+    const config = await setPricingTierGroup(mode, tiers)
+    await publishConfigInvalidate(`pricing_${mode}_tiers_json`)
+    return reply.send({ success: true, data: config })
+  })
+
+  // --- Phase 4: Support handles ---
+  app.get('/support-handles', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (_req, reply) => {
+    return reply.send({ success: true, data: await getSupportHandles() })
+  })
+
+  app.patch('/support-handles', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'update')],
+  }, async (request, reply) => {
+    const { wa, telegram } = request.body ?? {}
+    const validateHandle = (h, name) => {
+      if (h === undefined) return null
+      if (typeof h !== 'object' || h === null) return `${name} must be an object`
+      if (h.label !== undefined && typeof h.label !== 'string') return `${name}.label must be a string`
+      if (h.deeplink !== undefined && typeof h.deeplink !== 'string') return `${name}.deeplink must be a string`
+      return null
+    }
+    for (const [name, value] of [['wa', wa], ['telegram', telegram]]) {
+      const err = validateHandle(value, name)
+      if (err) return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: err } })
+    }
+    const config = await setSupportHandles({ wa, telegram })
+    await publishConfigInvalidate('support_handles_json')
+    return reply.send({ success: true, data: config })
+  })
 }