[P1] Reduce duplicate business logic between `client/lib` and `backend/src`

[Calebux]

Summary

Domain logic such as analytics, subscription handling, and security helpers is split across multiple layers without a clear source of truth.

Scope

• Area: architecture
• Priority: P1
• Backlog ID: #8

Acceptance Criteria

• Shared logic candidates are identified.
• Logic is centralized into shared/ or clearly separated by responsibility.
• Duplication hotspots are removed.

Implementation Notes

• Keep the implementation aligned with current architecture decisions and security constraints in this repo.
• Include tests for changed behavior and update docs where relevant.

Definition of Done

• Acceptance criteria met
• Tests added/updated and passing
• Documentation updated
• No security regressions introduced

Links

• Backlog source: docs/repo-issue-backlog-2026-05.md

[dykdee]

@dykdee has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

I would like to work on this issue because reducing duplicated business logic will make the application easier to maintain and help prevent inconsistencies between the client and backend.

I have experience working with frontend and backend code, organizing shared logic, and making careful refactors without changing existing behaviour. I can review the current implementation, identify repeated logic around analytics, subscriptions, and security helpers, then move or separate it clearly while adding or updating tests where needed while ensuring clear documentation.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dykdee to this issue.

[drips-wave]

Congratulations, @dykdee! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 2, 2026.

🧑‍💻 @dykdee: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[dykdee]

Opened PR #776 for this: #776

I kept the change scoped to shared pure business logic: billing-cycle spend math, URL safety checks, email/API-key masking helpers, tests, and docs. I also left the existing React/Tremor peer dependency issue out of scope.