Verify and close out Epic E5: packages & payments (#30–#36)

[Copilot]

Verification pass confirming all Epic E5 features (package model, PKR pricing config, payment workflow, student dashboard summary, package selection, admin payment actions) were shipped correctly in #96. No missing implementations found; all acceptance criteria met.

Summary

Full audit of E5 against issue specs in #31–#36.

Changes

• T5.1 (T5.1 package model (8/12/20 sessions, monthly) #33) — packages + payments + audit_logs tables confirmed in supabase/migrations/20260224000001_create_packages_payments.sql with correct schema (tier_sessions in (8,12,20)), indexes, and RLS policies
• T5.2 (T5.2 pricing config in PKR (admin editable later; hardcode for MVP) #34) — lib/config/pricing.ts exports PACKAGES (PKR 8k/11k/16k) and PAYMENT_INSTRUCTIONS; no inline price literals in component files
• T5.3 (T5.3 payment workflow (manual confirmation MVP) #35) — Student payment page (app/dashboard/packages/[id]/page.tsx) shows bank instructions + proof upload (5 MB, image/PDF, sanitized path); admin payments page + markPaymentPaid/markPaymentRejected server actions with atomic multi-table updates, best-effort rollback, and audit log
• T5.4 (T5.4 student dashboard shows: package type, sessions remaining, month window #36) — PackageSummary component shows tier, month window, sessions remaining, progress bar; handles pending/active/expired states; embedded per request on student dashboard
• S5.1 (S5.1 as a parent/student, I can select a package (8/12/20) and see PKR pricing #31) — Package selection page shows 3 tier cards from config, guards against duplicate active/pending packages, advances request to payment_pending
• S5.2 (S5.2 as an admin, I can mark payment as received and activate the package Tickets: #32) — markPaymentPaid atomically flips payment→paid, package→active, request→ready_to_match with rollback on partial failure; PaymentActions.tsx surfaces errors via useActionState

Testing

• Verified locally
• Checked key flows manually

Notes

• One pre-existing ESLint warning in app/dashboard/requests/new/page.tsx (React Hook Form watch() memoization compatibility) — unrelated to E5, not introduced here
• Bank transfer fields in PAYMENT_INSTRUCTIONS are intentional CONFIGURE_BEFORE_LAUNCH placeholders per the pricing config design

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.