Add webhook logging, pagination, middleware, migrations, and prod hardening

- Webhook event logging repo and subscription webhook idempotency
- Pagination helper (echohelpers) with cursor/offset support
- Request ID and structured logging middleware
- Push client improvements (FCM HTTP v1, better error handling)
- Task model version column, business constraint migrations, targeted indexes
- Expanded categorization chain tests
- Email service and config hardening
- CI workflow updates, .gitignore additions, .env.example updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -25,6 +25,7 @@ type Config struct {
 	GoogleAuth GoogleAuthConfig
 	AppleIAP   AppleIAPConfig
 	GoogleIAP  GoogleIAPConfig
+	Features   FeatureFlags
 }
 
 type ServerConfig struct {
@@ -126,6 +127,17 @@ type StorageConfig struct {
 	AllowedTypes string // Comma-separated MIME types
 }
 
+// FeatureFlags holds kill switches for major subsystems.
+// All default to true (enabled). Set to false via env vars to disable.
+type FeatureFlags struct {
+	PushEnabled             bool // FEATURE_PUSH_ENABLED (default: true)
+	EmailEnabled            bool // FEATURE_EMAIL_ENABLED (default: true)
+	WebhooksEnabled         bool // FEATURE_WEBHOOKS_ENABLED (default: true)
+	OnboardingEmailsEnabled bool // FEATURE_ONBOARDING_EMAILS_ENABLED (default: true)
+	PDFReportsEnabled       bool // FEATURE_PDF_REPORTS_ENABLED (default: true)
+	WorkerEnabled           bool // FEATURE_WORKER_ENABLED (default: true)
+}
+
 var cfg *Config
 
 // Load reads configuration from environment variables
@@ -236,6 +248,14 @@ func Load() (*Config, error) {
 			ServiceAccountPath: viper.GetString("GOOGLE_IAP_SERVICE_ACCOUNT_PATH"),
 			PackageName:        viper.GetString("GOOGLE_IAP_PACKAGE_NAME"),
 		},
+		Features: FeatureFlags{
+			PushEnabled:             viper.GetBool("FEATURE_PUSH_ENABLED"),
+			EmailEnabled:            viper.GetBool("FEATURE_EMAIL_ENABLED"),
+			WebhooksEnabled:         viper.GetBool("FEATURE_WEBHOOKS_ENABLED"),
+			OnboardingEmailsEnabled: viper.GetBool("FEATURE_ONBOARDING_EMAILS_ENABLED"),
+			PDFReportsEnabled:       viper.GetBool("FEATURE_PDF_REPORTS_ENABLED"),
+			WorkerEnabled:           viper.GetBool("FEATURE_WORKER_ENABLED"),
+		},
 	}
 
 	// Validate required fields
@@ -302,6 +322,14 @@ func setDefaults() {
 	viper.SetDefault("APPLE_IAP_SANDBOX", true) // Default to sandbox for safety
 
 	// Google IAP defaults - no defaults needed, will fail gracefully if not configured
+
+	// Feature flags (all enabled by default)
+	viper.SetDefault("FEATURE_PUSH_ENABLED", true)
+	viper.SetDefault("FEATURE_EMAIL_ENABLED", true)
+	viper.SetDefault("FEATURE_WEBHOOKS_ENABLED", true)
+	viper.SetDefault("FEATURE_ONBOARDING_EMAILS_ENABLED", true)
+	viper.SetDefault("FEATURE_PDF_REPORTS_ENABLED", true)
+	viper.SetDefault("FEATURE_WORKER_ENABLED", true)
 }
 
 func validate(cfg *Config) error {