✅ Phase 5: Contact backend + full polish/QA (done)

Contact wired + a comprehensive audit pass. English site now feature-complete. Deployed to preview.

Part A, Contact (Contact Form): /api/contact validates length + email, honeypot (clip-path hidden, tabindex -1, aria-hidden) → fake success, 5/min/IP → 429, swallows spam (link-stuffing/shouting/keywords). Resend send, reply-to = submitter, Stone plain+HTML template → saifmd238@gmail.com. Env-driven: no RESEND_API_KEY → {ok, simulated} (verified dev + preview). Form success/error/rate-limited states drive off real responses, aria-live intact; verified end-to-end in browser.

Part B, audit results:

Phase 2 watch item fixed: keyboard focus into either pinned featured card scrubs the pin to fully reveal it (0.5/covered → focus link → opacity 1, in viewport, focus retained). SR reachability never blocked (opacity ≠ hidden); Shoppin also reachable via sitemap/llms/graph.
axe WCAG 2.1 AA: zero violations across 8 combos (/, /work/shoppin, /brain, /analytics × themes + /ar/ + /ur/work/shoppin). Skip link first Tab; canvases aria-hidden; one h1/main.
Localized OG: 7 per-locale home cards (native names, Nastaliq+RTL verified) + 4 case-study cards via scripts/generate-og.mjs; correct og:locale (ur_PK, ar_AE…) + per-page og:image; all 294 pages point at an existing file.
SEO: clean, 294 sitemap URLs resolve, x-default everywhere, canonicals exact, JSON-LD parses, zero broken internal links, 16 AI crawlers in robots.txt, llms.txt present, English pages ship zero Noto bytes.
Lighthouse matrix (4 pages × mobile/desktop): desktop 100 perf; mobile 96–97; a11y 100 + SEO 100 all 8; CLS 0, TBT 0. (BP 96 = localhost Speed Insights 404.)
Cross-browser: Firefox 152 + Chromium clean; no overflow 320px→4K; RTL re-verified via axe on ar/ur.

Punch list (deferred, intentional):

Safari/WebKit automated run needs admin pw → do one manual Safari pass at launch.
Launch env vars (each activates a finished feature): AI Gateway card → /api/ask; Neon+Upstash → analytics; RESEND_API_KEY (+ CONTACT_FROM after domain verify) → real email. (D017 - Defer External Service Activation)
Real domain: SITE in astro.config + robots sitemap line + regenerate OG (footer prints placeholder domain).
Bulk translation (D015 - Defer Content Translation), Phase 6.
Field INP from Speed Insights once domain live.

Next: Phase 6, translation tooling; then Phase 7 launch.