- Wired the checkout wizard for Google “comfort login”: added Socialite controller + dependency, new Google env

hooks in config/services.php/.env.example, and updated wizard steps/controllers to store session payloads,
attach packages, and surface localized success/error states.
- Retooled payment handling for both Stripe and PayPal, adding richer status management in CheckoutController/
PayPalController, fallback flows in the wizard’s PaymentStep.tsx, and fresh feature tests for intent
creation, webhooks, and the wizard CTA.
- Introduced a consent-aware Matomo analytics stack: new consent context, cookie-banner UI, useAnalytics/
useCtaExperiment hooks, and MatomoTracker component, then instrumented marketing pages (Home, Packages,
Checkout) with localized copy and experiment tracking.
- Polished package presentation across marketing UIs by centralizing formatting in PresentsPackages, surfacing
localized description tables/placeholders, tuning badges/layouts, and syncing guest/marketing translations.
- Expanded docs & reference material (docs/prp/*, TODOs, public gallery overview) and added a Playwright smoke
test for the hero CTA while reconciling outstanding checklist items.

docs/todo/event-join-token-hardening.md

@@ -27,12 +27,12 @@ Replace slug-based guest access with opaque, revocable join tokens and provide p
 - [x] Build “QR & Invites” management UI (list tokens, usage stats, rotate/revoke).
 - [x] Hook Filament action + PWA screens to call new token endpoints.
 - [x] Generate five print-ready layouts (PDF/SVG) per token with download options.
-- [ ] Deprecate slug-based QR view; link tenants to new flow.
+- [x] Deprecate slug-based QR view; link tenants to new flow.
 
 ## Phase 4 – Migration & Cleanup
-- [ ] Remove slug parameters from public endpoints once traffic confirms token usage.
-- [ ] Update documentation (PRP, onboarding guides, runbooks) to reflect token process.
-- [ ] Add feature/integration tests covering expiry, rotation, and guest flows.
+- [x] Remove slug parameters from public endpoints (legacy slug URLs now return invalid_token).
+- [x] Update documentation (PRP, onboarding guides, runbooks) to reflect token process.
+- [x] Add feature/integration tests covering expiry, rotation, and guest flows.
 
 ## Open Questions
 - Decide on default token lifetime and rotation cadence.