new changes

architecture/2026/19-saas-hardening-phase-implementation.md

@@ -0,0 +1,34 @@
+# Phase 7 Implementation: SaaS Hardening
+
+## Delivered scope
+
+### Quotas and plan enforcement hooks
+- Added `QuotaService` for tenant resource checks.
+- Added `BillingHooksService` for usage event emission.
+- Added APIs:
+  - `POST /api/v1/saas/quotas/check`
+  - `POST /api/v1/saas/usage-events`
+
+### Webhook management
+- Added webhook controller for endpoint CRUD/test placeholders.
+- Added APIs:
+  - `GET /api/v1/webhooks`
+  - `POST /api/v1/webhooks`
+  - `POST /api/v1/webhooks/test`
+
+### Scoped public API
+- Added token service and public API controller.
+- Added APIs:
+  - `POST /api/v1/public/tokens`
+  - `POST /api/v1/public/tokens/introspect`
+
+## Data model additions
+- `plan_limits`
+- `usage_counters`
+- `webhook_endpoints`
+- `webhook_deliveries`
+- `public_api_tokens`
+
+## Notes
+- This phase establishes hardening boundaries and contracts.
+- Token/hash generation, secret encryption, and retry workers are the next productionization tasks.