feat: 2-year feature roadmap for Ottabase

[Copilot]

Adds ROADMAP.MD — an exhaustive 40-item, 2-year feature roadmap for the monorepo, targeting solopreneurs and small teams building SaaS, pet projects, and homepages on Cloudflare Workers.

Structure

• Year 1 — Foundational Platform (20 items): revenue primitives, auth hardening, DX, and core missing UI
• Year 2 — Growth, Content & AI (20 items): AI toolkit, page builder, analytics UI, enterprise SSO, collaborative UI

Format per item

• Title + description
• Why it's needed (no fluff)
• 2–3 paragraph implementation sketch with copy-paste snippets grounded in existing Ottabase conventions (fat models, OttaORM hooks, edge-safe code)
• Effort: XS / S / M / L / XL
• Impact: 🔴 Critical / 🟠 High / 🟡 Medium / 🟢 Nice-to-have

Top Y1 items

#	Package / Feature	Effort	Impact
1	@ottabase/payments — Stripe/Paddle subscriptions + Subscription fat model	L	🔴
2	@ottabase/feature-flags — KV-backed per-org/plan toggles	M	🟠
3	@ottabase/api-keys — hashed, scoped machine keys	M	🟠
4	@ottabase/ui-data-table — TanStack Table v8, server-side sort/filter/pagination	M	🟠
5	@ottabase/webhooks — outbound delivery via @ottabase/queue, HMAC-signed	M	🟠
6	OttaORM: soft deletes + chainable query scopes	S	🟠
7	scripts: interactive create-app wizard (@clack/prompts)	S	🟠

Top Y2 items

@ottabase/ai, @ottabase/pages (visual page builder), @ottabase/usage-metering, analytics funnel/cohort UI, queue DLQ + monitoring, OttaORM optimistic locking, cf-realtime presence/typing indicators, multi-app deploy orchestration.

All snippets use CSPRNG-safe token generation (crypto.getRandomValues) for security-sensitive operations (API keys, invitation tokens) and AES-256-GCM for secrets at rest (TOTP).

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.