review-frontend

Domain review checklist for the trovex web/ surface — the Vite/React/TypeScript landing + savings-calculator app AND the Vercel serverless API functions (web/api/*.js) behind it (lead capture, Twenty-CRM mirror, inbound webhook, OG-card/badge generators). Applies to a diff under web/. Ordered highest-weight first: the public serverless surface (secrets, webhook auth, abuse, cache-poisoning, injection) leads;…