refactor(pricing): single source of truth for the service catalog

Previously two hand-maintained price lists (API COMPLIANCE_SERVICES + site
SERVICE_META) drifted apart -- that is how the healthcare +$200 raise charged
$399 while displaying $599. Eliminate the drift class entirely:

- Move the catalog to api/src/service-catalog.ts (the authority; checkout
  charges from it). compliance-orders.ts imports it.
- scripts/gen-service-catalog.mjs generates site/src/lib/service-catalog.generated.ts
  from the API source. intake_manifest.ts re-exports SERVICE_META from it, so all
  ~60 site pages keep working unchanged.
- deploy.sh regenerates + drift-checks before building (site build context is
  ./site only and cannot read ../api, so generation happens host-side).
- scripts/check-service-catalog-drift.mjs fails the build if the generated file
  ever diverges from the API (verified: passes aligned, fails on mismatch).

To change a price now, edit ONE file: api/src/service-catalog.ts.

scripts/check-service-catalog-drift.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+/**
+ * Drift guard: the site's generated catalog MUST match the API source.
+ *
+ * Run in CI / pre-deploy. Regenerates the catalog into memory from
+ * api/src/service-catalog.ts and compares it to the committed
+ * site/src/lib/service-catalog.generated.ts. Fails (exit 1) on any difference,
+ * so a price edited in the API but not regenerated, or the generated file
+ * hand-edited, is caught before it reaches customers.
+ *
+ * Usage: node scripts/check-service-catalog-drift.mjs
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, "..");
+const GEN = resolve(ROOT, "site/src/lib/service-catalog.generated.ts");
+
+// Regenerate to a temp string by invoking the generator's parse logic inline.
+const SRC = resolve(ROOT, "api/src/service-catalog.ts");
+const tsSource = readFileSync(SRC, "utf8");
+const m = tsSource.match(/export const COMPLIANCE_SERVICES[^=]*=\s*(\{[\s\S]*?\n\});/);
+if (!m) { console.error("drift-check: cannot parse API catalog"); process.exit(1); }
+const apiCatalog = Function(`"use strict"; return (${m[1]});`)();
+
+// Parse the committed generated file's SERVICE_META.
+const genSource = readFileSync(GEN, "utf8");
+const gm = genSource.match(/export const SERVICE_META[^=]*=\s*(\{[\s\S]*?\n\});/);
+if (!gm) { console.error("drift-check: cannot parse generated SERVICE_META"); process.exit(1); }
+const gen = Function(`"use strict"; return (${gm[1]});`)();
+
+let problems = [];
+for (const slug of Object.keys(apiCatalog)) {
+  const a = apiCatalog[slug];
+  const g = gen[slug];
+  if (!g) { problems.push(`${slug}: missing from generated file`); continue; }
+  if (a.price_cents !== g.price_cents) problems.push(`${slug}: price API=${a.price_cents} generated=${g.price_cents}`);
+  if (a.name !== g.name) problems.push(`${slug}: name mismatch`);
+  if ((a.gov_fee_label || undefined) !== (g.gov_fee_label || undefined)) problems.push(`${slug}: gov_fee_label mismatch`);
+}
+for (const slug of Object.keys(gen)) {
+  if (!apiCatalog[slug]) problems.push(`${slug}: in generated file but not in API`);
+}
+
+if (problems.length) {
+  console.error("SERVICE CATALOG DRIFT DETECTED (run: node scripts/gen-service-catalog.mjs):");
+  for (const p of problems) console.error("  - " + p);
+  process.exit(1);
+}
+console.log(`drift-check: OK -- ${Object.keys(apiCatalog).length} services, API and generated catalog match.`);

scripts/gen-service-catalog.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * Generate the site's read-only service catalog from the API's single source.
+ *
+ * Source : api/src/service-catalog.ts  (COMPLIANCE_SERVICES -- the authority)
+ * Output : site/src/lib/service-catalog.generated.ts  (SERVICE_META for display)
+ *
+ * Run automatically before the site build (site `prebuild` script). Never edit
+ * the generated file by hand. To change a price or name, edit the API catalog.
+ *
+ * We import the API module directly (it is plain TS with a literal object), via
+ * a tiny transpile-free parse: the catalog is a static object literal, so we
+ * evaluate it in a sandboxed module context.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, "..");
+const SRC = resolve(ROOT, "api/src/service-catalog.ts");
+const OUT = resolve(ROOT, "site/src/lib/service-catalog.generated.ts");
+
+const tsSource = readFileSync(SRC, "utf8");
+
+// Extract the object literal assigned to COMPLIANCE_SERVICES.
+const m = tsSource.match(/export const COMPLIANCE_SERVICES[^=]*=\s*(\{[\s\S]*?\n\});/);
+if (!m) {
+  console.error("[gen-service-catalog] could not locate COMPLIANCE_SERVICES object literal in", SRC);
+  process.exit(1);
+}
+// The object literal is valid JS (string keys, number/bool/string values, trailing commas).
+// Evaluate it safely in an isolated function scope (no access to anything).
+let catalog;
+try {
+  catalog = Function(`"use strict"; return (${m[1]});`)();
+} catch (e) {
+  console.error("[gen-service-catalog] failed to evaluate catalog literal:", e);
+  process.exit(1);
+}
+
+const slugs = Object.keys(catalog).sort();
+const lines = slugs.map((slug) => {
+  const s = catalog[slug];
+  const parts = [`name: ${JSON.stringify(s.name)}`, `price_cents: ${s.price_cents}`];
+  if (s.gov_fee_label) parts.push(`gov_fee_label: ${JSON.stringify(s.gov_fee_label)}`);
+  return `  ${JSON.stringify(slug)}: { ${parts.join(", ")} },`;
+});
+
+const out = `/**
+ * AUTO-GENERATED -- DO NOT EDIT.
+ *
+ * Source of truth: api/src/service-catalog.ts (COMPLIANCE_SERVICES).
+ * Regenerate with: node scripts/gen-service-catalog.mjs (runs on site prebuild).
+ *
+ * Display-only subset (name, price_cents, gov_fee_label) of the API catalog,
+ * so the public site can never drift from what the API actually charges.
+ */
+
+export interface ServiceMeta {
+  name: string;
+  price_cents: number;
+  gov_fee_label?: string;
+}
+
+export const SERVICE_META: Record<string, ServiceMeta> = {
+${lines.join("\n")}
+};
+`;
+
+writeFileSync(OUT, out);
+console.log(`[gen-service-catalog] wrote ${slugs.length} services -> ${OUT}`);