feat(web): real 3-step wizard, settings, audit, docs, marketing pages

Sprint 3.5: close every dead link and replace the single-step wizard with the
spec-mandated 3-step flow.

Wizard:
- Step 1 collects prompt + name + slug, calls /v1/servers/preview.
- Step 2 renders parsed tools (name, description, input schema as copyable JSON)
  + a credential field per requiredSecret Claude actually identified. Self-contained
  servers see 'No credentials needed' instead of generic Notion placeholders.
- Step 3 streams the live build over WebSocket and shows install snippets.

New dashboard pages:
- /settings — org, plan/usage, members table, API keys + billing stubs (Sprint 4),
  encryption status. Reads /v1/me/org.
- /audit — filterable table over /v1/audit with action pills, resource refs, IP,
  metadata JSON.

Docs site (/docs + 6 sub-pages):
- Sticky 240px sidebar, max-w-prose article column, shared DocsTitle/H2/Code primitives.
- Quickstart, MCP concepts, OAuth 2.1 flow (full walkthrough with curl), Authoring
  tools, Self-hosting, API reference, FAQ.

Marketing pages:
- /changelog with tagged release timeline.
- /security with 8 pillars + disclosure.
- /privacy with GDPR-aware sections.
- /terms (10 clauses).
- /pricing full page (nav now points here instead of /#pricing anchor).
- /status with live 10s probes against /api/health and /login.

Footer 'system status' badge now links to /status.

All 20 routes 200 OK in smoke crawl. Typecheck clean across packages.

CHOICES.md

@@ -82,3 +82,68 @@ for prod. No CJS.
 ## Conventional commits per task, single branch
 Single `main` branch, conventional-commits messages. No PR flow because this is one
 autonomous run.
+
+---
+
+# Sprint 3.5 — Real 3-step wizard, filled-in pages
+
+Done after live-running the Sprint 1-3 build and finding two UX gaps:
+1. The wizard was a single-step that asked for secrets the user didn't necessarily need.
+2. Half the nav links 404'd because the marketing/dashboard surfaces had un-built routes.
+
+## Two-phase generation (preview → cache → build)
+The wizard now runs Claude twice in spirit but **only once on the wire**:
+- Step 1 → `POST /v1/servers/preview` calls Claude synchronously, validates the spec, and
+  caches it in Redis under `preview:<id>` with a 5-minute TTL.
+- Step 2 renders the parsed tools + the credentials *Claude actually identified*.
+  No more generic Notion placeholders — the form is the spec.
+- Step 3 → `POST /v1/servers` carries `previewId`. The BullMQ worker reads the cached
+  spec from Redis (`loadCachedSpec`) and skips the second Claude round-trip. Saves ~30s.
+
+If the cache is missed (TTL expired or restart) the worker regenerates fresh and logs
+a `warn` so the build still completes.
+
+## Shared `@bmm/llm` package
+`SYSTEM_PROMPT` + `generateSpec()` + `SpecValidationError` + `BannedPatternError` live
+in `packages/llm`. Both `apps/api` (for the synchronous preview path) and
+`apps/generator` (for the worker path) import the same module. No code duplication, no
+prompt drift between the two surfaces.
+
+## Audit log writes
+`apps/api/src/lib/audit.ts` exposes a single `audit()` helper that swallows its own
+errors (audit failures never block the request path). Five write sites:
+- `auth.login`, `auth.logout`, `server.create`, `server.iterate`, `server.delete`.
+- Each entry includes `orgId`, `userId`, `resourceType`, `resourceId`, `metadata`,
+  `ipAddress`. The `/audit` UI page reads from `GET /v1/audit?limit=&action=`.
+
+## All marketing + dashboard links now resolve
+Built out the previously-404 routes as full pages (no "Coming soon" placeholders):
+- `/docs` + 6 sub-pages (Quickstart, MCP concepts, OAuth flow, Authoring tools,
+  Self-hosting, API reference, FAQ) under a static sidebar layout. MDX migration is
+  Sprint 4; for Sprint 3.5 they're plain TSX with the new `<DocsTitle>`,
+  `<DocsH2>`, `<DocsCode>` primitives.
+- `/changelog` — release timeline with tags (launch / feature / fix).
+- `/security` — eight pillars with bodies (per-server isolation, encryption,
+  OAuth 2.1, no-token-passthrough, static checks, container hardening, audit log,
+  rate limiting) plus disclosure email and compliance roadmap.
+- `/privacy` — six sections (what we collect, what we don't, where it lives,
+  subprocessors, retention, GDPR rights).
+- `/terms` — ten clauses.
+- `/pricing` — full grid of the four tiers + pricing FAQ. Marketing nav now points
+  to `/pricing` instead of the landing anchor.
+- `/status` — live JS probes against the dashboard and `/api/health` every 10s.
+
+## Settings + Audit dashboard pages
+- `/settings` reads `GET /v1/me/org` and renders five cards: Organization, Plan & usage,
+  Members (table), API keys (Sprint 4 stub), Encryption (read-only status).
+- `/audit` reads `GET /v1/audit` and renders a filterable table with action pills,
+  resource refs, IP, and metadata JSON.
+
+## What's *still* Sprint 4
+- Real Stripe billing (the "Manage billing" button in /settings is intentionally
+  disabled).
+- Pagefind search in /docs.
+- MDX migration of the docs pages.
+- Real BetterStack-hosted status board at status.buildmymcpserver.com.
+- Custom domain CNAME validation per server.
+- `bmm` CLI + per-org API keys.