deploy Maps v6 update

README.md

@@ -5,11 +5,11 @@ the bundled [gosom/google-maps-scraper](https://github.com/gosom/google-maps-scr
 worker, waits for its asynchronous job to finish, filters places already in
 the local catalogue, and presents the remaining places for human review.
 
-The interface is intentionally focused: discovery, run progress, catalogue
-search, and review status. It does not send outreach, create a CRM campaign, or
-make an AI decision. The opportunity score is a transparent triage hint based
-on fields returned by Maps (for example, a missing website and a listed phone
-number); you make the final review decision.
+The interface includes discovery, run progress, catalogue search, website
+health and email evidence, explainable scoring, domain ideas, suppression,
+CSV export, scheduled runs, rescans, and human review. It never sends outreach
+automatically. Optional AI can analyse a prospect and draft a subject/email
+from supplied evidence and your offer; you edit and approve the draft yourself.
 
 ## Start the stack
 
@@ -47,6 +47,9 @@ error rather than remaining stuck forever.
 | `GMAPS_REQUEST_TIMEOUT` | `300` | Per-job scraper timeout in seconds |
 | `GMAPS_POLL_SECONDS` | `2` | Poll interval while a job is running |
 | `DISCOVERY_BACKEND` | `gmaps` when `GMAPS_URL` is set | Set to `browser` only for the bounded public-search fallback |
+| `AI_BASE_URL` | empty | Optional OpenAI-compatible `/chat/completions` endpoint |
+| `AI_API_KEY` | empty | Optional provider key; keep server-side |
+| `AI_MODEL` | empty | Model name used for evidence-grounded drafts |
 
 The app stores its catalogue in the `prospect_data` Docker volume. The worker
 stores its own job data in `gmaps_data`; keep both volumes if you want to retain
@@ -73,14 +76,23 @@ and review UI, and does not bypass CAPTCHAs or other access controls.
 
 Each saved place includes its name, Maps link, website (when present), root
 domain, address, phone, category, rating, review count, public emails returned
-by the worker when explicitly enabled, source ID, and raw result JSON. A place
+by the worker when available, source ID, and raw result JSON. A place
 with no website is still retained using a stable `maps:<place_id>` catalogue
 key, so it can be reviewed as a potential website opportunity. Existing
 websites are deduplicated by root domain.
 
-Email extraction is off by default in the UI. If you enable it for a run, the
-worker may visit the public business website; expect a longer run and review
-the resulting provenance before using any contact information.
+Email extraction is always enabled. The worker may visit each public business
+website found by Maps; expect longer runs and review the resulting provenance
+before using any contact information. It does not invent email addresses when
+none are published.
+
+Website scans are bounded and SSRF-safe. A scan records HTTP status, final URL,
+latency, HTTPS/TLS, title, technology hints, contact-page emails, and errors.
+Use `/api/prospects/{id}/scan` for a manual rescan. The explorer's “Draft AI
+email” action calls `/api/prospects/{id}/message`; it requires the optional AI
+variables above and accepts your exact offer/instructions (for example, the
+Gold Plus R119/month plan and a free rebuild). Suppressions are enforced before
+new records are saved and can be managed through `/api/suppressions`.
 
 ## Tests