Add member profile questions, admin tooling, legal pages, and fast tests

- Add configurable profile questions with conditional visibility, admin-only fields, user answers, and seeded onboarding/volunteer questions
  - Add admin UI for managing profile questions and member profile answers
  - Add volunteer level/profile data support across backend schemas, models, API, and migration
  - Update dashboard/profile UI, super admin menu, membership service types, and related styling
  - Add privacy policy, terms of service, cookie notice, and footer links
  - Add frontend Vitest coverage for profile question logic
  - Add backend pytest coverage for profile answer normalization and validation
  - Update restart.sh to build, run frontend/backend unit tests, and restart only after tests pass
  - Refresh README, quickstart, project structure, instructions, and Square docs to match current app features
    - Protect feature flag reload behind super-admin access
    - Restrict admin-triggered password resets so admins can only reset member accounts
    - Replace email template HTML preview rendering with escaped text preview
    - Update docs for feature flag reload access, password reset scope, and email template preview safety

    -- test user questions are also made by AI and not very useful. but i didn't know what to put there so its good enough for a test

README.md

@@ -1,24 +1,32 @@
 # Swansea Airport Stakeholders' Alliance Membership Management System
 
-A comprehensive membership management system built with FastAPI, MySQL, and Docker.
+A membership management system for Swansea Airport Stakeholders' Alliance, built with FastAPI, React, MySQL-compatible storage, Square payments, SMTP2GO email services, and Docker Compose.
 
 ## Features
 
-- **User Management**: Registration, authentication, and profile management
-- **Membership Tiers**: Configurable membership levels with different benefits and fees
-- **Payment Processing**: Support for Square payments, cash, and check payments
-- **Admin Dashboard**: Complete administrative control over members and payments
-- **Event Management**: Create and manage events with RSVP tracking (coming soon)
-- **Volunteer Management**: Role assignments, scheduling, and certificates (coming soon)
-- **Email Notifications**: Automated notifications via SMTP2GO (coming soon)
+- **Authentication and accounts**: Registration, JSON/form login, JWT sessions, password reset, password change, and role-based access for members, admins, and super admins.
+- **Member portal**: Dashboard with membership status, payment history, membership setup, account settings, profile editing, configurable profile questions, cookie notice, privacy policy, and terms of service pages.
+- **Admin operations**: User listing/editing, admin-triggered member password reset emails, membership tier CRUD, manual payment recording, Square refunds, email template editing with escaped previews, SMTP2GO bounce management, profile-question management, and super-admin feature-flag reloads.
+- **Membership tiers**: Configurable Personal, Aircraft Owners, Corporate, and custom tiers with annual fees, descriptions, active/inactive state, and benefits.
+- **Memberships and payments**: Membership lifecycle tracking, Square card payments, cash/check/manual payments, dummy test payments, payment history, transaction IDs, refund state, and payment-to-membership linking.
+- **Events and RSVPs**: Event CRUD, upcoming event listing, member RSVP updates, RSVP status tracking, attendance fields, and admin RSVP visibility.
+- **Volunteer and profile data**: Volunteer flag/level support, configurable member profile questions, conditional questions, admin-only answers, seeded aviation/volunteering questions, and data models for volunteer roles, assignments, schedules, and certificates.
+- **Email system**: SMTP2GO-backed email sending, default database templates, editable templates, welcome/password-reset/test emails, bounce webhooks, bounce stats, cleanup, and manual deactivation.
+- **Feature flags**: Backend feature-flag service with frontend context and admin status/reload controls.
+- **Testing**: Fast frontend Vitest unit tests and backend pytest unit tests wired into `restart.sh`.
 
 ## Tech Stack
 
 - **Backend**: FastAPI (Python 3.11)
+- **Frontend**: React 18, TypeScript, Vite, Tailwind CSS
 - **Database**: MySQL 8.0
 - **Authentication**: JWT tokens with OAuth2
 - **Containerization**: Docker & Docker Compose
 - **ORM**: SQLAlchemy
+- **Migrations**: Alembic
+- **Payments**: Square Web Payments SDK and Square API
+- **Email**: SMTP2GO
+- **Tests**: Vitest and pytest
 
 ## Project Structure
 
@@ -37,7 +45,11 @@ membership/
 │   │   │   │   ├── users.py         # User management
 │   │   │   │   ├── tiers.py         # Membership tiers
 │   │   │   │   ├── memberships.py   # Membership management
-│   │   │   │   └── payments.py      # Payment processing
+│   │   │   │   ├── payments.py      # Payment processing
+│   │   │   │   ├── email.py         # SMTP2GO email and bounces
+│   │   │   │   ├── email_templates.py
+│   │   │   │   ├── events.py        # Events and RSVPs
+│   │   │   │   └── feature_flags.py
 │   │   │   └── dependencies.py       # Auth dependencies
 │   │   ├── core/
 │   │   │   ├── config.py            # Configuration
@@ -50,8 +62,13 @@ membership/
 │   │   └── main.py                  # Application entry point
 │   ├── Dockerfile
 │   └── requirements.txt
-├── database/
-│   └── init.sql                     # Legacy database initialization (deprecated - use Alembic migrations)
+├── frontend/
+│   ├── src/
+│   │   ├── components/              # Dashboard, payment, admin, profile components
+│   │   ├── contexts/                # Feature flag context
+│   │   ├── pages/                   # Login, register, dashboard, policy pages
+│   │   ├── services/                # API clients
+│   │   └── utils/                   # Tested frontend logic
 ├── docker-compose.yml
 ├── .env.example
 └── README.md
@@ -95,6 +112,25 @@ membership/
    - API Documentation: http://localhost:8050/docs
    - TLS certs are generated automatically by the gateway container on first start
 
+## Restart and Test Gate
+
+`restart.sh` rebuilds images with cache, runs the fast frontend and backend unit tests, then restarts the stack only if tests pass:
+
+```bash
+./restart.sh
+```
+
+The current fast test suite covers:
+- frontend profile-question visibility and editability rules with Vitest
+- backend profile-question option parsing, answer normalization/deserialization, select validation, and volunteer flag normalization with pytest
+
+You can also run them individually:
+
+```bash
+docker compose run --rm frontend npm test
+docker compose run --rm backend pytest -q
+```
+
 ## Frontend Development vs Production
 
 ### Development Mode (Vite)
@@ -191,6 +227,39 @@ docker compose --profile prod down
 - `PUT /api/v1/payments/{id}` - Update payment (admin)
 - `GET /api/v1/payments/` - List all payments (admin)
 - `POST /api/v1/payments/manual-payment` - Record manual payment (admin)
+- `GET /api/v1/payments/config/square` - Get frontend Square config
+- `POST /api/v1/payments/square/process` - Process Square card payment
+- `POST /api/v1/payments/square/refund` - Refund Square payment (admin)
+
+### Profile Questions
+- `GET /api/v1/users/me/profile-questions` - List active questions with current answers
+- `PUT /api/v1/users/me/profile-answers` - Update editable answers
+- `GET /api/v1/users/admin/profile-questions` - List all profile questions (admin)
+- `POST /api/v1/users/admin/profile-questions` - Create profile question (admin)
+- `PUT /api/v1/users/admin/profile-questions/{id}` - Update profile question (admin)
+- `DELETE /api/v1/users/admin/profile-questions/{id}` - Deactivate profile question (admin)
+- `GET /api/v1/users/admin/users/{id}/profile-answers` - View user answers (admin)
+- `PUT /api/v1/users/admin/users/{id}/profile-answers` - Update user answers (admin)
+
+### Events
+- `GET /api/v1/events/` - List events
+- `GET /api/v1/events/upcoming` - List upcoming events
+- `POST /api/v1/events/` - Create event (admin)
+- `PUT /api/v1/events/{id}` - Update event (admin)
+- `DELETE /api/v1/events/{id}` - Delete event (admin)
+- `GET /api/v1/events/{id}/rsvps` - List RSVPs (admin)
+- `POST /api/v1/events/{id}/rsvp` - Create or update current user's RSVP
+
+### Email and Feature Flags
+- `POST /api/v1/email/test-email` - Send test email
+- `POST /api/v1/email/test-welcome-email` - Send test welcome email
+- `POST /api/v1/email/webhooks/smtp2go/bounce` - Receive SMTP2GO bounce webhook
+- `GET /api/v1/email/bounces` - List bounces
+- `GET /api/v1/email/bounces/stats` - Bounce statistics
+- `GET /api/v1/email-templates/` - List templates
+- `PUT /api/v1/email-templates/{template_key}` - Update template
+- `GET /api/v1/feature-flags/flags` - List flags
+- `POST /api/v1/feature-flags/flags/reload` - Reload flags (super admin)
 
 ## Docker Compose Commands
 
@@ -362,16 +431,13 @@ docker compose up -d
 docker compose logs -f
 ```
 
-## Next Steps
+## Remaining Roadmap
 
-- [ ] Implement Square payment integration
-- [ ] Add email notification system
-- [ ] Create event management endpoints
-- [ ] Add volunteer management features
-- [ ] Build frontend interface
-- [ ] Add file upload/management
-- [ ] Implement automated renewal reminders
+- [ ] Add member file upload/repository endpoints and UI
+- [ ] Add richer volunteer role, assignment, schedule, and certificate screens on top of the existing models
+- [ ] Implement automated renewal reminder batch jobs
 - [ ] Add reporting and analytics
+- [ ] Expand test coverage around authenticated API flows and payment/email service boundaries
 
 ## License