Refine workspaces and event publishing; harden uploads and email delivery

docs/verification.md

@@ -0,0 +1,24 @@
+# Local verification — September 9, 2026
+
+- `bun run check`: unit tests, typecheck, lint and production build passed.
+- Clean-database migration check passed, including the webhook inbox migration.
+- Opt-in publishing integration passed with real storage/worker processing:
+  note-only and email-only guests, approval reset, hidden statistics, scheduled
+  publication and note/gallery visibility, submission opening, gallery policies,
+  unauthorized upload completion rejection, concurrent completion deduplication,
+  direct presigned upload, smaller display/thumbnail outputs, and closed/draft
+  rejection. Source: one existing demo original, left untouched.
+- Mailpit integration passed: opt-in only, concurrent enqueue deduplication,
+  provider acceptance and no repeat notification.
+- Webhook tests passed: valid/invalid/stale signatures, ignored event types,
+  duplicate and early callbacks, out-of-order terminal outcomes, event-scoped
+  query and provider separation. No production Resend requests were sent.
+- Browser: guest form checked at 390×844 with no horizontal overflow or console
+  warnings/errors; organizer People tab loaded delivery history successfully.
+  Temporary viewport override was reset.
+
+Temporary test events and uploaded copies were removed by fixture cleanup.
+Mailpit test messages remain available. These checks do not replace real-device
+camera/HEIC testing or production deliverability verification. Resend webhook
+registration and its signing secret are deployment configuration, not activated
+by local tests. See `email-delivery.md`.