feat: Swiss-compliant launch — Impressum/AGB/Contact, support panel, DSG exports, cookie banner

Legal (Swiss minimum, no individual named):
- Impressum page (UWG Art. 3 lit. s) — provider, contact via support panel,
  no email required, jurisdiction = Switzerland
- AGB page — subscription terms, payment, cancellation, suspension on payment
  fail, 14-day money-back, AI-processing-per-tier disclosure, Swiss law +
  Swiss venue, modeled after typical Schweizer SaaS terms
- Privacy: Stripe added as subprocessor with full data-flow disclosure

Support panel replaces email contact entirely:
- @bmm/db: support_status enum + support_tickets + support_messages tables,
  migration applied to prod DB
- @bmm/api: support routes (user create/list/view/reply, admin list/view/reply
  /set-status), public /v1/contact for logged-out visitors with per-IP rate
  limit of 3 submissions/day to prevent spam-flood
- Web: /settings/support (list + new), /settings/support/[id] (conversation),
  /admin/support, /admin/support/[id]
- Public /contact form with email collection for guest tickets

Data rights (DSG Art. 25 / GDPR Art. 15+20):
- /v1/account/export returns user-scoped JSON of profile, org, servers,
  builds, audit, support tickets and messages — excludes hashes, encrypted
  secrets, other-user data
- /settings/account: download button + deletion-via-ticket workflow

Production-readiness gaps closed:
- org.suspended now blocks /v1/servers POST and /v1/servers/preview (402);
  webhook flagged this state but enforcement was missing
- Cookie banner: minimal, essential-cookies-only disclosure (Swiss DSG +
  GDPR compliant without dark-pattern consent UI), mounts on both layouts

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/admin/support/[id]/page.tsx

@@ -0,0 +1,197 @@
+'use client';
+
+import { Textarea } from '@/components/input';
+import { Button } from '@/components/ui/button';
+import { apiFetch } from '@/lib/api';
+import { Loader2 } from 'lucide-react';
+import Link from 'next/link';
+import { useParams } from 'next/navigation';
+import { useEffect, useState } from 'react';
+
+interface Ticket {
+  id: string;
+  subject: string;
+  status: 'awaiting_admin' | 'awaiting_user' | 'closed';
+  guestEmail: string | null;
+  createdAt: string;
+  lastMessageAt: string;
+}
+
+interface Message {
+  id: string;
+  authorIsAdmin: boolean;
+  body: string;
+  createdAt: string;
+}
+
+interface Detail {
+  ticket: Ticket;
+  userEmail: string | null;
+  userName: string | null;
+  messages: Message[];
+}
+
+export default function AdminTicketDetail() {
+  const params = useParams<{ id: string }>();
+  const [data, setData] = useState<Detail | null>(null);
+  const [reply, setReply] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  function load() {
+    if (!params?.id) return;
+    apiFetch<Detail>(`/v1/admin/support/tickets/${params.id}`)
+      .then(setData)
+      .catch((e) => setError((e as Error).message));
+  }
+
+  useEffect(load, [params?.id]);
+
+  async function sendReply(e: React.FormEvent) {
+    e.preventDefault();
+    if (!params?.id || reply.trim().length === 0) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await apiFetch(`/v1/admin/support/tickets/${params.id}/messages`, {
+        method: 'POST',
+        body: JSON.stringify({ body: reply }),
+      });
+      setReply('');
+      load();
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function setStatus(status: Ticket['status']) {
+    if (!params?.id) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await apiFetch(`/v1/admin/support/tickets/${params.id}/status`, {
+        method: 'POST',
+        body: JSON.stringify({ status }),
+      });
+      load();
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  if (!data && !error) {
+    return (
+      <div className="mx-auto max-w-3xl px-6 py-12 text-center">
+        <Loader2 className="mx-auto animate-spin text-[--color-fg-muted]" size={20} />
+      </div>
+    );
+  }
+
+  if (error || !data) {
+    return (
+      <div className="mx-auto max-w-3xl px-6 py-12">
+        <p className="text-[13px] text-[--color-danger]">{error ?? 'Ticket not found.'}</p>
+        <Link href="/admin/support" className="mt-3 inline-block text-[12px] text-[--color-fg-muted] hover:text-[--color-fg]">
+          ← Back to tickets
+        </Link>
+      </div>
+    );
+  }
+
+  const { ticket, messages, userEmail, userName } = data;
+  const fromLabel = userEmail
+    ? `${userName ? `${userName} · ` : ''}${userEmail}`
+    : ticket.guestEmail
+      ? `${ticket.guestEmail} (guest)`
+      : 'unknown';
+
+  return (
+    <div className="mx-auto max-w-3xl px-6 py-10">
+      <Link
+        href="/admin/support"
+        className="text-[12px] text-[--color-fg-muted] hover:text-[--color-fg]"
+      >
+        ← All tickets
+      </Link>
+      <div className="mt-3 flex items-baseline justify-between gap-3">
+        <div className="min-w-0 flex-1">
+          <h1 className="text-[22px] font-semibold tracking-tight">{ticket.subject}</h1>
+          <p className="mt-1 text-[12px] text-[--color-fg-muted]">From: {fromLabel}</p>
+        </div>
+        <span className="mono text-[10.5px] uppercase tracking-wider text-[--color-fg-subtle]">
+          {ticket.status.replace('_', ' ')}
+        </span>
+      </div>
+
+      <div className="mt-6 space-y-3">
+        {messages.map((m) => (
+          <div
+            key={m.id}
+            className={`panel p-4 ${m.authorIsAdmin ? 'border-[--color-accent]/40' : ''}`}
+          >
+            <div className="flex items-baseline justify-between">
+              <span
+                className={`text-[11.5px] font-medium ${m.authorIsAdmin ? 'text-[--color-accent]' : 'text-[--color-fg]'}`}
+              >
+                {m.authorIsAdmin ? 'Admin' : 'User'}
+              </span>
+              <span className="text-[10.5px] text-[--color-fg-subtle]">
+                {new Date(m.createdAt).toLocaleString()}
+              </span>
+            </div>
+            <p className="mt-2 whitespace-pre-wrap text-[13px] leading-relaxed text-[--color-fg-muted]">
+              {m.body}
+            </p>
+          </div>
+        ))}
+      </div>
+
+      <form onSubmit={sendReply} className="panel mt-6 space-y-3 p-4">
+        <Textarea
+          value={reply}
+          onChange={(e) => setReply(e.target.value)}
+          rows={4}
+          maxLength={10_000}
+          placeholder="Reply to user…"
+        />
+        {error && <p className="text-[12.5px] text-[--color-danger]">{error}</p>}
+        <div className="flex items-center justify-between gap-2">
+          <div className="flex gap-1">
+            <Button
+              variant="ghost"
+              size="sm"
+              type="button"
+              onClick={() => setStatus('closed')}
+              disabled={busy || ticket.status === 'closed'}
+            >
+              Mark closed
+            </Button>
+            {ticket.status === 'closed' && (
+              <Button
+                variant="ghost"
+                size="sm"
+                type="button"
+                onClick={() => setStatus('awaiting_admin')}
+                disabled={busy}
+              >
+                Reopen
+              </Button>
+            )}
+          </div>
+          <Button
+            variant="primary"
+            size="md"
+            type="submit"
+            disabled={busy || reply.trim().length === 0}
+          >
+            {busy ? 'Sending…' : 'Send reply'}
+          </Button>
+        </div>
+      </form>
+    </div>
+  );
+}

apps/web/app/admin/support/page.tsx

@@ -0,0 +1,132 @@
+'use client';
+
+import { apiFetch } from '@/lib/api';
+import { Loader2 } from 'lucide-react';
+import Link from 'next/link';
+import { useEffect, useState } from 'react';
+
+interface AdminTicketRow {
+  ticket: {
+    id: string;
+    subject: string;
+    status: 'awaiting_admin' | 'awaiting_user' | 'closed';
+    guestEmail: string | null;
+    createdAt: string;
+    lastMessageAt: string;
+  };
+  userEmail: string | null;
+  userName: string | null;
+}
+
+const STATUS_BADGE: Record<AdminTicketRow['ticket']['status'], string> = {
+  awaiting_admin: 'bg-amber-500/20 text-amber-300',
+  awaiting_user: 'bg-emerald-500/20 text-emerald-300',
+  closed: 'bg-[--color-bg-subtle] text-[--color-fg-subtle]',
+};
+
+export default function AdminSupport() {
+  const [rows, setRows] = useState<AdminTicketRow[] | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [filter, setFilter] = useState<'all' | 'awaiting_admin' | 'awaiting_user' | 'closed'>(
+    'awaiting_admin',
+  );
+
+  useEffect(() => {
+    apiFetch<{ tickets: AdminTicketRow[] }>('/v1/admin/support/tickets')
+      .then((r) => setRows(r.tickets))
+      .catch((e) => setError((e as Error).message));
+  }, []);
+
+  const filtered = (rows ?? []).filter(
+    (r) => filter === 'all' || r.ticket.status === filter,
+  );
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-8">
+      <div className="flex items-baseline justify-between">
+        <div>
+          <Link href="/admin" className="text-[12px] text-[--color-fg-muted] hover:text-[--color-fg]">
+            ← Admin
+          </Link>
+          <h1 className="mt-1 text-[22px] font-semibold tracking-tight">Support tickets</h1>
+        </div>
+        <div className="flex gap-1">
+          {(['awaiting_admin', 'awaiting_user', 'closed', 'all'] as const).map((s) => (
+            <button
+              type="button"
+              key={s}
+              onClick={() => setFilter(s)}
+              className={`rounded-md px-2.5 py-1 text-[11.5px] transition-colors ${
+                filter === s
+                  ? 'bg-[--color-bg-subtle] text-[--color-fg]'
+                  : 'text-[--color-fg-muted] hover:text-[--color-fg]'
+              }`}
+            >
+              {s.replace('_', ' ')}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      {error && <p className="mt-4 text-[12.5px] text-[--color-danger]">{error}</p>}
+
+      <div className="panel mt-6">
+        {rows === null && (
+          <div className="p-6 text-center">
+            <Loader2 className="mx-auto animate-spin text-[--color-fg-muted]" size={18} />
+          </div>
+        )}
+        {rows && filtered.length === 0 && (
+          <div className="p-6 text-center text-[13px] text-[--color-fg-muted]">
+            No tickets in this view.
+          </div>
+        )}
+        {rows && filtered.length > 0 && (
+          <table className="w-full text-[12.5px]">
+            <thead className="border-b border-[--color-border] text-[--color-fg-subtle]">
+              <tr>
+                <th className="px-4 py-2 text-left font-medium">Subject</th>
+                <th className="px-4 py-2 text-left font-medium">From</th>
+                <th className="px-4 py-2 text-left font-medium">Status</th>
+                <th className="px-4 py-2 text-left font-medium">Last activity</th>
+              </tr>
+            </thead>
+            <tbody>
+              {filtered.map((r) => (
+                <tr
+                  key={r.ticket.id}
+                  className="border-b border-[--color-border] last:border-0 hover:bg-[--color-bg-subtle]"
+                >
+                  <td className="px-4 py-2.5">
+                    <Link
+                      href={`/admin/support/${r.ticket.id}`}
+                      className="font-medium hover:text-[--color-accent]"
+                    >
+                      {r.ticket.subject}
+                    </Link>
+                  </td>
+                  <td className="mono px-4 py-2.5 text-[--color-fg-muted]">
+                    {r.userEmail ??
+                      (r.ticket.guestEmail
+                        ? `${r.ticket.guestEmail} (guest)`
+                        : 'unknown')}
+                  </td>
+                  <td className="px-4 py-2.5">
+                    <span
+                      className={`rounded-full px-2 py-0.5 text-[10.5px] ${STATUS_BADGE[r.ticket.status]}`}
+                    >
+                      {r.ticket.status.replace('_', ' ')}
+                    </span>
+                  </td>
+                  <td className="px-4 py-2.5 text-[--color-fg-muted]">
+                    {new Date(r.ticket.lastMessageAt).toLocaleString()}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        )}
+      </div>
+    </div>
+  );
+}