payments.md: flag the smtp_* columns dormant and the companion email plan superseded. HOW_IT_WORKS.md predated recurring subscriptions and merchant profiles -- correct 'not a subscription service' (subscriptions ship on paid tiers), the single-tenant / one-box-one-business framing (merchant profiles let one instance host multiple businesses), and the 'short of an email' aside (Keysat never emails keys).
Glue files not covered by subproject repos: top-level docs, logo,
keysat-design-system, and crosscheck tests. Subproject folders are
gitignored (each has its own Gitea remote).
Keysat