Sprint 2: first-party offers vertical slice

[hynding]

Summary

Implements the Sprint 2 plan (docs/superpowers/plans/2026-07-06-sprint-2-offers.md): the first-party offers slice, end to end on the Sprint 0-1 foundation.

• Contracts: offer creative / placement-response / click schemas (offerId wire field, kebab-case placement slugs)
• Core: OfferDefinition + pure resolveOffer (UTC schedule window computed on read, inclusive start / exclusive end, priority wins) + OfferMetricsStore port; ConfigStore gains getOffers
• Adapter-db: append-only runtime.offer_events (impressions/clicks; deliberately no read-modify-write — see Fix lost-update race on achievement progress counters #3)
• CMS: Placement + Offer content types, GET /config-plane/offers behind the shared-secret guard, seed ("Welcome to Promocean" on homepage-banner)
• Adapter-strapi: getOffers with TTL cache + stale-on-error
• API: GET /v1/placements/:slug/offer (records impressions; metric failures never fail the response) + POST /v1/offers/:id/click, both param-bounded per repo convention
• SDK: getPlacementOffer, fire-and-forget clickOffer, localStorage dismissal with SSR-safe fallback
• Widgets: <Placement> with CTA click tracking, accessible dismiss, and an http(s) scheme allowlist on creative URLs (stored-XSS fix caught by security review mid-sprint)
• Demo + e2e: banner renders → dismiss → stays dismissed across reload

Test plan

• 14 API tests, full workspace 30/30 turbo tasks green
• Both Playwright e2e specs passed live (achievement-loop + offer-loop) — the offer-loop green run is Sprint 2's definition of done
• CI e2e job runs both specs on a fresh seeded DB — watch the checks on this PR

Review notes

Nine tasks, each through implement → review → fix → re-review, plus a final whole-branch review (verdict: ready with fixes; param-validation fix applied in 873e02c and re-approved). Follow-ups filed/updated: #6 (offer impression accuracy: dismissed-offer impressions, retry duplicates, priority-tie determinism), #4 and #5 extended with offers-path scope.

🤖 Generated with Claude Code