docs: master pre-launch to-do list (paused before go-live)

Consolidates outstanding items so nothing is lost during the pause: domain
decision, content placeholders, MK/SI proofread, GA4 setup, plus a record of
what's already hardened. Dev-only doc (docs/ excluded from deploy).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/PRE-LAUNCH-TODO.md

@@ -0,0 +1,47 @@
+# MSOS — Pre-Launch To-Do (master list)
+
+Paused before go-live. This is the running list of what's left. Detailed
+placeholder inventory lives in `PRE-LAUNCH-CHECKLIST.md`; GA4 setup in
+`GA4-ASSISTANT-REPORT.md`.
+
+## 🔴 Must do before launch
+
+- [ ] **Domain decision (most important).** The live site runs on
+      `msos.spletnimojster.si`. `msosorg.com` does NOT serve the files (404s),
+      but all SEO tags (canonical/hreflang/sitemap) point to it.
+      - Option A: ask the host (Spletni Mojster) to point `msosorg.com` at the
+        same site folder → then re-add the canonical redirect (Claude can do the code).
+      - Option B: stay on `msos.spletnimojster.si` → flip the SEO tags to it (Claude can script this).
+- [ ] **Homepage placeholder content** — replace Lorem-ipsum testimonials and the
+      leftover "Everything you need to know about the product and billing" line (en/mk/si).
+- [ ] **"Coming soon" cards** — blog index (9) and news index (3), ×3 languages: publish or hide.
+- [ ] **Student-guide hero images** — 31 pages ×3 languages still show an "Image placeholder" box.
+- [ ] **MSOS Hub photos** — replace the temporary placeholder photos (see code comments in `msos-hub`).
+- [ ] **Proofread MK/SI** — the machine-drafted curated assistant answers (`assistant.js` INTENTS)
+      and meta descriptions on legal / msos-hub / support.
+- [ ] **Confirm Support-page bank details** are correct real values (IBAN SI56 0284 3026 6115 703 / SWIFT LJBASI2X).
+
+## 🟡 Should do
+
+- [ ] **GA4 custom dimensions** for the assistant (`q`, `result`, `q_lang`, `page_lang`) — see `GA4-ASSISTANT-REPORT.md`. Do this early so data collects.
+- [ ] **Test the newsletter end-to-end** — a real MailerLite subscribe + confirmation email.
+- [ ] **Commit the blog pages** once their content is finished (they already have the assistant widget in the working tree, uncommitted).
+- [ ] **Privacy/cookie policy** — confirm it names Google (Analytics + Forms) and MailerLite as processors, and explains how to request data deletion (email info@msosorg.com). (Covers GDPR "user data deletion".)
+
+## 🟢 Nice to have
+
+- [ ] Wire the homepage "story" video (currently the play button was removed; image kept), or leave as-is.
+- [ ] Re-compress the 6 images >250 KB; delete the stale unused `style.css`.
+- [ ] Periodically bump Font Awesome (currently 6.5.1, pinned + SRI) and regenerate its integrity hash.
+- [ ] Confirm the host takes docroot backups (source is already version-controlled in Gitea; form data in Google Sheets / MailerLite).
+
+## ✅ Done (for reference — already live/hardened)
+
+- Security headers (HSTS, enforcing CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
+- HTTPS forced (http→https) + HSTS
+- Content-Security-Policy **enforcing** (browser + production verified, 0 violations)
+- Exposed-file lockdown (code dump, dev scripts, `.git`, `docs/`, directory listing all 403 live)
+- XSS-safe output escaping (+ live-tested the one user-input page)
+- No secrets in code; no PII in browser storage/URLs; no file uploads; no permissive CORS
+- Accessibility (alt text, lang, labels, keyboard mobile menu), image dimensions (CLS), broken-page fixes
+- Offline "Ask MSOS" assistant (search + curated answers, analytics, auto-rebuilding index)