add new GDPR page and handle account creation email

frontend/src/routes/signup/+page.server.ts

@@ -6,6 +6,7 @@ import { setSessionCookie } from '$lib/server/session';
 import { issueAccess } from '$lib/server/member-otp';
 import { slugify, handle, famUsername, handleOf } from '@shared/slugify';
 import { applyAccessCode } from '$lib/server/access';
+import { sendWelcomeEmail, sendAccessUnlockedEmail } from '$lib/server/email';
 import { createEmbeddedCheckoutSession, PLAN_IDS } from '$lib/server/stripe';
 import type { PlanId } from '$lib/server/stripe';
 
@@ -70,6 +71,10 @@ export const actions = {
 			.catch(() => null);
 		if (authResult?.token) setSessionCookie(event.cookies, authResult.token);
 
+		// Welcome email — a best-effort send. Failures must not block signup.
+		const dashboardUrl = `${event.url.origin}/${slug}`;
+		sendWelcomeEmail({ to: email, famName, dashboardUrl }).catch(() => {});
+
 		return { success: true, famSlug: slug, username: handleName };
 	},
 
@@ -111,6 +116,27 @@ export const actions = {
 		const result = await applyAccessCode(user.famId, code);
 		if (result.error) return fail(400, { error: result.error });
 
+		// Access code applied successfully — confirm by email (best-effort).
+		// Failure must never block the user continuing to the plan step.
+		if (result.ok) {
+			const fam = await pbAdmin
+				.getOne('fams', user.famId)
+				.catch(() => ({ name: '', slug: user.famId }));
+			const parents = await pbAdmin
+				.getList('users', `famId = '${user.famId}' && role = 'parent'`)
+				.catch(() => []);
+			const parentEmail = (parents[0] as { email?: string } | undefined | null)?.email;
+			if (parentEmail) {
+				sendAccessUnlockedEmail({
+					to: parentEmail,
+					famName: fam.name || '',
+					codeName: result.code?.name || code,
+					codeValue: code,
+					dashboardUrl: `${event.url.origin}/${fam.slug || user.famId}`
+				}).catch(() => {});
+			}
+		}
+
 		return { ok: true, ...result };
 	},
 
@@ -148,4 +174,4 @@ export const actions = {
 function requireUser(event: RequestEvent) {
 	if (!event.locals.user) throw redirect(303, '/signup');
 	return event.locals.user;
-}
+}