security: Add proper authentication, RBAC, and tenant isolation

- Add password hashing with bcrypt
- Add AuthService with proper login
- Add password strength validation
- Add RBAC middleware (AdminOnly, ManagerOrAdmin)
- Add tenant isolation middleware
- Update CRM handler with tenant filtering
- Add JWT fallback for development mode
- Add user context helpers
- Build successful

QUIXZOOM_LANDVEX_CERTIFICATION_STATUS.md

@@ -0,0 +1,138 @@
+# GLOBAL CERTIFICATION STATUS – quiXzoom & Landvex
+
+**Issued by:** Erik Svensson  
+**Date:** 2026-06-18  
+**Status:** NOT CERTIFIED
+
+---
+
+## Verified Foundation
+
+✓ Single backend  
+✓ Single authentication layer  
+✓ Single database architecture  
+✓ Unified product vision  
+✓ Centralized platform design  
+✓ Scalable international architecture  
+
+---
+
+## P0 — BLOCKING REQUIREMENTS
+
+### Country-domain routing verified and operational
+
+Required domains:
+- quixzoom.se / landvex.se
+- quixzoom.no / landvex.no
+- quixzoom.dk / landvex.dk
+- quixzoom.fi / landvex.fi
+- quixzoom.de / landvex.de
+- quixzoom.fr / landvex.fr
+- quixzoom.es / landvex.es
+- quixzoom.it / landvex.it
+- quixzoom.us / landvex.us
+
+Pass criteria: Every domain resolves correctly and serves the intended localized experience.
+
+### hreflang implementation complete
+
+Every public page must contain:
+- Self-reference hreflang
+- Alternate language references
+- x-default reference
+- Correct canonical relationships
+
+Pass criteria: Google can fully understand all market relationships without ambiguity.
+
+---
+
+## P1 — CRITICAL INFRASTRUCTURE
+
+### Country template generation system
+
+Accepted approaches: Jinja2, Nunjucks, static generation pipeline, or equivalent.  
+Pass criteria: No manual duplication of country pages.
+
+### Locale Registry
+
+Single source of truth. Structure per market:
+- Country
+- Domain
+- Language
+- Currency
+- Legal profile
+- Analytics profile
+- Support profile
+
+Pass criteria: New countries added through configuration only.
+
+### Expanded i18n layer
+
+Required locales: sv, en, de, fr, no, da, fi, es, it  
+Pass criteria: Platform language switching works from centralized translation resources.
+
+---
+
+## P2 — CONTENT DISTRIBUTION
+
+### Core market launch content
+
+Required: quixzoom.se, .no, .dk, .fi, .us  
+Pass criteria: Localized production-ready pages published.
+
+### City page deployment
+
+Minimum 3 cities per country at launch.
+
+Examples:
+- Sweden: Stockholm, Göteborg, Malmö
+- Germany: Berlin, Hamburg, München
+- USA: New York, Miami, Los Angeles
+
+### Local FAQ and legal content
+
+Per country: Terms, Privacy, Cookie policy, FAQ, Support documentation.
+
+---
+
+## P3 — MEASUREMENT & GOVERNANCE
+
+### Analytics and Search Console
+
+Each domain requires: Google Search Console, GA4, conversion tracking, indexing monitoring.
+
+### Brand Governance Repository
+
+Formal documentation: naming conventions, design system, messaging, localization rules, SEO rules, domain rules.
+
+---
+
+## Estimated Certification Effort
+
+| Phase | Effort |
+|---|---|
+| P0 | 1–2 days |
+| P1 | ~1 week |
+| P2 | ~2–3 weeks |
+| P3 | ~1 week (parallel) |
+
+---
+
+## Readiness Scores
+
+| Area | Score |
+|---|---|
+| Architecture Readiness | 95% |
+| Localization Readiness | 40% |
+| SEO Readiness | 35% |
+| Content Readiness | 25% |
+| Governance Readiness | 50% |
+| **Global Expansion Readiness** | **55%** |
+
+---
+
+## Conclusion
+
+The platform architecture is correctly designed for international scale. The remaining work is not architectural — it consists of localization automation, SEO deployment, content distribution, market-specific configuration, and governance formalization.
+
+Certification is achievable within approximately 4–5 weeks of focused execution across P0–P3.