Added a rules card on the referral dashboard so partners see at a glance: 15% recurring commission, 20% off first month for the referred, paid forever as long as they stay subscribed.
The signup page now always shows a hint next to the Referral Code field — "Have a referral code? Get 20% off your first month." — so new sign-ups discover the perk even without a referral link.
Polished mobile layout on referral login and signup screens (input fields and buttons now align cleanly within the card).
Invoice Discount Reason
The invoice detail panel and printable PDF now show the discount reason line, so the referral first-month discount is clearly attributed (e.g. "Referral: 20% off first month (PURPLE-XXXX)").
Security Hardening
Anonymous access to restaurant data is now blocked. Admin email, business registration number, tax ID, and subscription status are no longer exposed to unauthenticated callers.
A few internal pages were calling APIs without the auth header — fixed.
Comprehensive audit logging across the payment flow: commission credits, payout requests/reviews, subscription restores all leave a trail for dispute tracing.
Operational Reliability
Server logs now auto-rotate (10MB max, gzip, 14–30 day retention) so the disk no longer fills up over time.
Uploaded images and attachments are now included in the daily backup and cross-replicated to a secondary server.
Per-route rate limits on signup, password reset, and admin analytics endpoints (anti-spam, DB protection).
Backend code split: large invoice / brand / foodcourt route files are now broken into logical sub-modules for long-term maintainability.