refactor: Move marketing connectors to shared services

.env.example

@@ -50,17 +50,8 @@ NEXT_PUBLIC_AZURE_AD_API_SCOPE=
 # Marketing ΓÇö Static Web Apps (public: plattform-kit.poc.singletonsd.com)
 AZURE_MARKETING_SWA_NAME=ssd-pocpk-mkt-dev-ae
 AZURE_MARKETING_URL=https://plattform-kit.poc.singletonsd.com
-# Astro build-time origin for Contact → marketing-edge Function (not Nest)
-PUBLIC_MARKETING_API_BASE_URL=https://ssd-pocpk-decap-oauth-dev-ae.azurewebsites.net
-# Marketing-edge Function / Forward Email (also set on Function App via Bicep + KV)
-# KV secret name: forwardemail-api-key
-FORWARDEMAIL_API_KEY=
-FORWARDEMAIL_BASE_URL=https://api.forwardemail.net
-CONTACT_INBOX_EMAIL=hello@singletonsd.com
-CONTACT_FROM_EMAIL=noreply@mail.plattform-kit.poc.singletonsd.com
-# PoC in-memory limiter on Function (per instance); default 5 / 60s
-CONTACT_RATE_LIMIT_PER_MIN=5
-CONTACT_RATE_LIMIT_WINDOW_MS=60000
+# Astro build-time origin for Contact → shared PostKit API
+PUBLIC_POSTKIT_API_BASE_URL=https://ssd-postkit-api-prod-ae.azurewebsites.net
 # Service Bus (topics = {pillar}.events)
 AZURE_SERVICEBUS_NAMESPACE=
 AZURE_SERVICEBUS_CONNECTION_STRING=
@@ -118,7 +109,7 @@ EMAIL_LOGO_URL=https://api.plattform-kit.poc.singletonsd.com/bimi/logo.svg
 EMAIL_BIMI_EVIDENCE_URL=
 # Production App Service / Functions must set EMAIL_PROVIDER=forward-email and:
 # EMAIL_ALLOW_PRODUCTION_SEND=true
-# Optional per-PoC/brand host map for marketing-edge contact flow.
+# Optional per-PoC/brand host map for trusted Platform Kit email callers.
 # Format: {"host":{"fromAddress":"...","fromName":"...","contactInboxAddress":"..."}}
 # CONTACT_EMAIL_PROFILES_BY_HOST={"inkads.poc.singletonsd.com":{"fromAddress":"noreply@mail.inkads.poc.singletonsd.com","fromName":"InkAds","contactInboxAddress":"inkads-support@singletonsd.com"}}
 

.github/workflows/ci-web.yml

@@ -7,7 +7,6 @@ on:
     paths:
       - 'apps/web/**'
       - 'apps/marketing/**'
-      - 'apps/marketing-oauth/**'
       - 'packages/**'
       - 'scripts/validate-staticwebapp-config.mjs'
       - 'scripts/validate-staticwebapp-config.test.mjs'
@@ -31,7 +30,6 @@ on:
     paths:
       - 'apps/web/**'
       - 'apps/marketing/**'
-      - 'apps/marketing-oauth/**'
       - 'packages/**'
       - 'scripts/validate-staticwebapp-config.mjs'
       - 'scripts/validate-staticwebapp-config.test.mjs'
@@ -92,20 +90,17 @@ jobs:
         run: |
           pnpm --filter @poc-plattform-kit/web... run lint
           pnpm --filter @poc-plattform-kit/marketing... run lint
-          pnpm --filter @poc-plattform-kit/marketing-oauth... run lint
           pnpm exec eslint .
 
       - name: Build (web + marketing + packages)
         run: |
           pnpm --filter @poc-plattform-kit/web... run build
           pnpm --filter @poc-plattform-kit/web run build-storybook
           pnpm --filter @poc-plattform-kit/marketing... run build
-          pnpm --filter @poc-plattform-kit/marketing-oauth... run build
           pnpm --filter "./packages/**" run build
 
       - name: Test (web + marketing + packages)
         run: |
           pnpm --filter @poc-plattform-kit/web... run test
           pnpm --filter @poc-plattform-kit/marketing... run test
-          pnpm --filter @poc-plattform-kit/marketing-oauth... run test
           pnpm --filter "./packages/**" run test

AGENTS.md

@@ -454,7 +454,7 @@ Pillars (no cross-pillar DB joins or write HTTP): **Tenant**, **SingleSignOn**,
 - DB: Azure SQL + Prisma `sqlserver`
 - Web: Next.js PWA SPA + Tailwind + [Singleton SD tokens](https://tokens.design.singletonsd.com/)
 - Marketing: Astro SSG + Tailwind + Singleton SD tokens + Markdown + Decap (`/admin`) - see [docs/marketing-astro-decap.md](docs/marketing-astro-decap.md); SWA Free `ssd-pocpk-mkt-dev-ae`
-- **Marketing edge (locked):** public anonymous HTTP for the brochure site (Contact form, future marketing-only endpoints) runs on Azure Function App `ssd-pocpk-decap-oauth-dev-ae` (`apps/marketing-oauth`, B1 `pocpk-plan`) - not on Nest `apps/api`. Stable client env: `PUBLIC_MARKETING_API_BASE_URL`. See [docs/marketing-edge.md](docs/marketing-edge.md). Split to a dedicated marketing API only when this host outgrows Decap OAuth + thin edge routes.
+- **Marketing connectors (locked):** Decap `/admin` GitHub login uses shared [`cms-oauth-kit`](https://github.com/singleton-sd/cms-oauth-kit/blob/main/AGENTS.md) (`https://auth.singletonsd.com`). Brochure Contact posts to shared [`PostKit`](https://github.com/singleton-sd/post-kit) via `PUBLIC_POSTKIT_API_BASE_URL`. This repo does not host OAuth or email Functions.
 - API: NestJS + Swagger on Azure App Service (prod/dev); **PR previews** on Azure Container Apps Consumption
 - **HTTP clients:** OpenAPI from Nest -> committed `packages/api-client/openapi.json` -> Orval TS client (`@poc-plattform-kit/api-client`); see `docs/openapi-client.md`
 - AuthN / coarse roles: Entra via **SingleSignOn** (e.g. tenant-admin, support-agent); Nest `APP_GUARD` session/JWT + `@Roles` - public allowlist in `docs/sso.md`
@@ -476,7 +476,9 @@ Pillars (no cross-pillar DB joins or write HTTP): **Tenant**, **SingleSignOn**,
 | Secrets (passwords, connection strings, SWA deploy token, ACR admin, Entra secrets, notification provider keys) | Key Vault `ssd-pocpk-kv-dev-ae` |
 | Non-secret app settings + KV references | App Configuration `ssd-pocpk-appcs-dev-ae` |
 
-Secret **names** (not values): `sql-admin-password`, `database-url`, `servicebus-connection-string`, `swa-deployment-token`, `swa-marketing-deployment-token`, `acr-admin-username`, `acr-admin-password`, `acr-login-server`, `forwardemail-api-key`, `sms-gateway-username`, `sms-gateway-password`, `whatsapp-cloud-access-token`, `appinsights-connection-string`, `auth-secret`, `azure-ad-client-secret`, `github-decap-oauth-client-secret`, `chromatic-project-token`, `clickup-api-token`.
+Secret **names** (not values): `sql-admin-password`, `database-url`, `servicebus-connection-string`, `swa-deployment-token`, `swa-marketing-deployment-token`, `acr-admin-username`, `acr-admin-password`, `acr-login-server`, `forwardemail-api-key`, `sms-gateway-username`, `sms-gateway-password`, `whatsapp-cloud-access-token`, `appinsights-connection-string`, `auth-secret`, `azure-ad-client-secret`, `chromatic-project-token`, `clickup-api-token`.
+
+Decap `/admin` uses [`cms-oauth-kit`](https://github.com/singleton-sd/cms-oauth-kit/blob/main/AGENTS.md). Marketing Contact email uses [`PostKit`](https://github.com/singleton-sd/post-kit).
 
 - **Local:** pull from KV / App Config. Never commit secrets. `.env` only as optional gitignored cache.
 - **CI (GitHub Actions):** OIDC login using repo **Variables** `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_SUBSCRIPTION_ID` (IDs only) -> `az keyvault secret show` or App Config at job runtime. **Never** put `AZURE_STATIC_WEB_APPS_API_TOKEN`, `AZURE_CREDENTIALS`, or other secrets in GitHub Secrets.
@@ -565,7 +567,7 @@ pnpm workspace (`apps/*`, `packages/*`, `pillars/*`), Node 20+/pnpm 9. Root scri
 
 - **API (reliably runnable):** NestJS + Swagger. `pnpm dev:api` (watch) serves on `PORT` (default 3000): health `/health`, Swagger UI `/docs`, OpenAPI JSON `/docs-json`. No DB/Prisma wiring yet, so it runs without live Azure resources.
 - **Web:** `pnpm dev:web` - Next.js PWA SPA (see `apps/web`).
-- **Marketing:** `pnpm dev:marketing` - Astro SSG + Tailwind + Singleton SD tokens; Markdown in `apps/marketing/src/content/`; Decap static admin at `/admin` (OAuth proxy follow-up). Build emits `apps/marketing/dist`. See `docs/marketing-astro-decap.md`.
+- **Marketing:** `pnpm dev:marketing` - Astro SSG + Tailwind + Singleton SD tokens; Markdown in `apps/marketing/src/content/`; Decap static admin at `/admin` (GitHub login via shared `cms-oauth-kit` at `https://auth.singletonsd.com`). Build emits `apps/marketing/dist`. See `docs/marketing-astro-decap.md`.
 - **Prisma needs `DATABASE_URL`:** `packages/db` scripts (`prisma validate`/`generate`, invoked by `pnpm test`/`pnpm build`) fail without it. Prisma reads `.env` from its own dir (cwd = `packages/db`), NOT the repo root, so the gitignored placeholder lives at `packages/db/.env` (created by the update script). Real value is in Azure Key Vault (`ssd-pocpk-kv-dev-ae`); the placeholder only covers schema validate/generate, not live queries.
 - **If `pnpm build` fails in `packages/events`** (build runs `tsc -p tsconfig.json`): older `main` is missing `packages/events/tsconfig.json` + a `typescript` dep; a pending ClickUp-tracked PR adds them. Until it merges, build the API directly with `pnpm --filter @poc-plattform-kit/api build`.
 - **`pnpm skills:install:pin`** pulls from GitHub (`singleton-sd/ai-plattform-skills`) into

SETUP.md

@@ -249,7 +249,7 @@ Topics: `tenant.events`, `single-sign-on.events`, `permissions.events`, `subscri
 
 Other pillars call Permissions (sync HTTP or cache); never embed authZ rules in Contact/etc. Optional permission-denial events -> Audit.
 
-**Key Vault secret names (not values):** `sql-admin-password`, `database-url`, `servicebus-connection-string`, `swa-deployment-token`, `swa-marketing-deployment-token`, `acr-admin-username`, `acr-admin-password`, `acr-login-server`, `forwardemail-api-key`, `sms-gateway-username`, `sms-gateway-password`, `whatsapp-cloud-access-token`, `appinsights-connection-string`, `auth-secret`, `azure-ad-client-secret`, `github-decap-oauth-client-secret`, `chromatic-project-token`
+**Key Vault secret names (not values):** `sql-admin-password`, `database-url`, `servicebus-connection-string`, `swa-deployment-token`, `swa-marketing-deployment-token`, `acr-admin-username`, `acr-admin-password`, `acr-login-server`, `forwardemail-api-key`, `sms-gateway-username`, `sms-gateway-password`, `whatsapp-cloud-access-token`, `appinsights-connection-string`, `auth-secret`, `azure-ad-client-secret`, `chromatic-project-token`
 
 **Org devtools Key Vault** (`ssd-devtools-kv-prod-ae`, subscription Singleton SD — CI/provision only, not app runtime): `github-automation-pat` (org-wide platform automation PAT). See **Platform GitHub automation PAT** above.
 
@@ -279,46 +279,9 @@ App registration: `ssd-pocpk-gha-oidc-dev` with federated credentials. Prefer **
 
 Consumes domain events + queue `notifications.send`; publishes `notification.sent` / `notification.failed` on `notifications.events`. Non-secret App Config: provider base URLs, WhatsApp phone-number-id, Graph API version (secrets only as KV references).
 
-### Marketing edge (locked)
+### Marketing connectors (locked)
 
-Public brochure HTTP (Contact form, etc.) runs on Function App **`ssd-pocpk-decap-oauth-dev-ae`** (`apps/marketing-oauth`), **not** Nest `apps/api`. See [`docs/marketing-edge.md`](docs/marketing-edge.md).
-
-**Forward Email - create secret + App Config (ops; do not commit values):**
-
-```powershell
-az account set --subscription 7b8343d7-969f-4b71-8864-b7925e7fae30
-
-# 1) Key Vault secret (prompt avoids shell history)
-az keyvault secret set `
-  --vault-name ssd-pocpk-kv-dev-ae `
-  --name forwardemail-api-key `
-  --file -   # paste token, Enter, then Ctrl+Z Enter on Windows - or use --value only in a private session
-
-# Prefer interactive file/stdin. Example with env var you set yourself (not committed):
-# $env:FORWARDEMAIL_API_KEY = '<paste once>'
-# az keyvault secret set --vault-name ssd-pocpk-kv-dev-ae --name forwardemail-api-key --value $env:FORWARDEMAIL_API_KEY
-# Remove-Item Env:FORWARDEMAIL_API_KEY
-
-# 2) App Config Key Vault reference (same content-type as other secret:* keys)
-az appconfig kv set `
-  --name ssd-pocpk-appcs-dev-ae `
-  --key secret:forwardemail-api-key `
-  --content-type "application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8" `
-  --value '{\"uri\": \"https://ssd-pocpk-kv-dev-ae.vault.azure.net/secrets/forwardemail-api-key\"}' `
-  --yes
-
-# 3) Non-secret contact delivery settings
-az appconfig kv set --name ssd-pocpk-appcs-dev-ae --key app:notifications:forwardEmailBaseUrl --value "https://api.forwardemail.net" --yes
-az appconfig kv set --name ssd-pocpk-appcs-dev-ae --key app:notifications:contactInboxEmail --value "hello@singletonsd.com" --yes
-az appconfig kv set --name ssd-pocpk-appcs-dev-ae --key app:notifications:contactFromEmail --value "noreply@mail.plattform-kit.poc.singletonsd.com" --yes
-```
-
-Verify (no secret values printed):
-
-```powershell
-az keyvault secret show --vault-name ssd-pocpk-kv-dev-ae --name forwardemail-api-key --query "{name:name, enabled:attributes.enabled}" -o json
-az appconfig kv show --name ssd-pocpk-appcs-dev-ae --key secret:forwardemail-api-key --query "{key:key, contentType:contentType}" -o json
-```
+Decap `/admin` login uses shared [`cms-oauth-kit`](https://github.com/singleton-sd/cms-oauth-kit) at `https://auth.singletonsd.com`. The brochure Contact form uses shared [`PostKit`](https://github.com/singleton-sd/post-kit) through `PUBLIC_POSTKIT_API_BASE_URL`. Platform Kit does not deploy a marketing OAuth or email Function.
 
 | Surface | Rule |
 | --- | --- |