feat: Leads Finder discovery + WordPress license validate + file storage
3 new PRD features:
1. Leads Finder discovery (PRD §6.2 Stage 1: Discover)
- Real SerpAPI integration (Google Maps local search)
- Real Tavily integration (web search API)
- Real Firecrawl integration (search + scrape)
- Returns company name, website, address, phone, description
- API key required (503 with hint if not configured)
- Rate limited, Zod validated, audit-logged
- POST /api/aos/leads/discover
2. WordPress-compatible license validation (PRD §6.4)
- POST /api/aos/licenses/validate
- WordPress plugin updater response format
- Domain auto-activation with max check
- Offline grace period (14 day default, configurable)
- Status checks: active/suspended/expired/revoked
- Rate limited (30/min), Zod validated, audit-logged
- Tested: active→valid✓, invalid→404, expired→403, suspended→403
3. Content-addressed file storage (PRD §5.5)
- src/lib/storage.ts
- SHA-256 hash addressing with sharded dirs (first 2 chars)
- Atomic writes (temp file → rename)
- Hash verified on read (tamper detection)
- Deduplication (same content = same hash = one file)
- Content type detection from magic numbers (PDF, PNG, JPEG, GIF, WebP, ZIP)
- storeFile(), readFile(), fileExists(), deleteFile()
0 TS errors, ESLint clean.
Z User
2aa3496a90