Phase 4 Stage 1: backend foundation (additive endpoints + schema)

Schema (idempotent migration):
- payment_sessions.is_free_trial -> is_first_session_discount (data copied)
- payment_sessions.mode TEXT NOT NULL DEFAULT 'chat' CHECK (chat|call)
- chat_sessions.topics TEXT[] for ESP picks (info-only)

New endpoints:
- GET /api/client/onboarding-state (drives verif sheet + S6 paywall gate)
- GET /api/client/chat-pricing (rewrite: chat+call groups + first-session
  discount block, per-customer eligibility)
- GET /api/shared/auth-providers (env-probed; replaces ENABLE_SOCIAL_AUTH
  build flag — frontend cutover lands in stage 2)
- GET /api/client/support-handles (Tanya Admin handles, CC-config-driven)

session_warning WS event fires once at 180s remaining.

app_config seeds (mock pricing tiers, first-session discount, support
handles, payment method order, end-session 2-step toggle).

CC SettingsPage: 3 new sections (first-session discount, pricing tiers
JSON editors, support handles).

15/15 Vitest passing. chat_sessions.is_free_trial also renamed for
consistency (plan only specified payment_sessions; pairing.service.js
read both).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/test/services/payment.service.test.js

@@ -38,8 +38,9 @@ describe('payment.service', () => {
     expect(session.customer_id).toBe(customer.id)
     expect(session.duration_minutes).toBe(15)
     expect(session.amount).toBe(30000)
-    expect(session.is_free_trial).toBe(false)
+    expect(session.is_first_session_discount).toBe(false)
     expect(session.is_extension).toBe(false)
+    expect(session.mode).toBe('chat')
     expect(new Date(session.expires_at).getTime()).toBeGreaterThan(before)
 
     // Verify it's actually persisted (not just returned from the INSERT)

backend/test/services/session-timer.service.test.js

@@ -0,0 +1,91 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+
+// Capture calls to sendToSessionParticipant so we can assert the 3-min warning event.
+vi.mock('../../src/plugins/websocket.js', () => ({
+  sendToUser: vi.fn(() => true),
+  sendToSessionParticipant: vi.fn(() => true),
+  registerWebSocketPlugin: vi.fn(),
+  registerWebSocketRoute: vi.fn(),
+  isUserOnlineWs: vi.fn(() => true),
+  getSessionConnections: vi.fn(() => ({})),
+}))
+
+vi.mock('../../src/services/notification.service.js', () => ({
+  sendPushNotification: vi.fn(async () => true),
+  registerDeviceToken: vi.fn(async () => {}),
+}))
+
+vi.mock('../../src/plugins/valkey.js', () => ({
+  publish: vi.fn(async () => {}),
+  subscribe: vi.fn(() => () => {}),
+}))
+
+const { sendToSessionParticipant } = await import('../../src/plugins/websocket.js')
+const { startSessionTimer, clearSessionTimer } = await import('../../src/services/session-timer.service.js')
+const { WsMessage, UserType } = await import('../../src/constants.js')
+
+describe('session-timer 3-minute warning (Phase 4)', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    sendToSessionParticipant.mockClear()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('emits session_warning kind:three_minutes_left exactly once at the 3-min mark', async () => {
+    const sessionId = 'sess-3min-test'
+    const expiresAt = new Date(Date.now() + 5 * 60_000) // 5 minutes from now
+
+    startSessionTimer(sessionId, expiresAt)
+
+    // Advance 1 min 59 s — well before the 2-min mark when the 3-min warning fires.
+    await vi.advanceTimersByTimeAsync(60_000 + 59_000)
+    const warnCallsEarly = sendToSessionParticipant.mock.calls.filter(
+      ([, , data]) => data?.type === WsMessage.SESSION_WARNING,
+    )
+    expect(warnCallsEarly).toHaveLength(0)
+
+    // Cross the 3-min-left threshold. 5 min total - 3 min = warning fires at t=2:00.
+    await vi.advanceTimersByTimeAsync(2_000)
+    // sendToSessionParticipant signature: (sessionId, userType, data)
+    const warnCalls = sendToSessionParticipant.mock.calls.filter(
+      ([, , data]) => data?.type === WsMessage.SESSION_WARNING,
+    )
+    expect(warnCalls).toHaveLength(1)
+    const [calledSessionId, userType, data] = warnCalls[0]
+    expect(calledSessionId).toBe(sessionId)
+    expect(userType).toBe(UserType.CUSTOMER)
+    expect(data.kind).toBe('three_minutes_left')
+    expect(data.session_id).toBe(sessionId)
+
+    // Cleanup before expiry hits.
+    clearSessionTimer(sessionId)
+  })
+
+  it('does NOT re-fire the 3-min warning when the timer is rescheduled (e.g. extension)', async () => {
+    const sessionId = 'sess-rescheduled'
+    const initial = new Date(Date.now() + 5 * 60_000)
+    startSessionTimer(sessionId, initial)
+
+    // Cross the 3-min mark on the original schedule.
+    await vi.advanceTimersByTimeAsync(2 * 60_000 + 1_000)
+    let warnCalls = sendToSessionParticipant.mock.calls.filter(
+      ([, , data]) => data?.type === WsMessage.SESSION_WARNING,
+    )
+    expect(warnCalls).toHaveLength(1)
+
+    // Extension reschedules — give a new 5-min window. The 3-min warning must NOT fire again.
+    const extended = new Date(Date.now() + 5 * 60_000)
+    startSessionTimer(sessionId, extended)
+    await vi.advanceTimersByTimeAsync(2 * 60_000 + 1_000)
+
+    warnCalls = sendToSessionParticipant.mock.calls.filter(
+      ([, , data]) => data?.type === WsMessage.SESSION_WARNING,
+    )
+    expect(warnCalls).toHaveLength(1) // still 1, no double-fire
+
+    clearSessionTimer(sessionId)
+  })
+})