docs(devops): document SMTP env vars for Hostinger mail integration

Expand the CI/CD env-var table to list all SMTP_*, MAIL_ADMIN_TO,
SMTP_FROM, SMTP_FROM_NAME and STARTTLS/timeout knobs that the contact
and "Tell us about your project" forms now rely on. Adds a note that
the production secrets live in the Default environment's platform
env-var store and that the frontend service must be restarted after
any change.

.agents/devops-engineer/CI_CD_PIPELINE.md

@@ -312,13 +312,26 @@ All env vars must be configured in your hosting platform, not in the workflow.
 | `NODE_ENV` | Yes | — | Must be `production` |
 | `HOST` | Yes | — | `0.0.0.0` |
 | `PORT` | Yes | — | `10000` |
-| `CONTACT_EMAIL` | No | — | Where contact form sends emails |
-| `SMTP_HOST` | No | — | Email server host |
-| `SMTP_USER` | No | — | Email server username |
-| `SMTP_PASS` | No | — | Email server password (use platform secrets) |
+| `CONTACT_EMAIL` | Yes (legacy) | — | Legacy admin recipient for contact form; kept for backward compatibility with older code paths. Mirror of `MAIL_ADMIN_TO`. |
+| `MAIL_ADMIN_TO` | Yes | — | Address that receives "Tell us about your project" and contact form submissions. |
+| `SMTP_HOST` | Yes | — | SMTP server hostname (e.g. `smtp.hostinger.com`). |
+| `SMTP_PORT` | Yes | `587` | SMTP server port. Use `587` for STARTTLS, `465` for implicit TLS. |
+| `SMTP_USER` | Yes | — | SMTP auth username (full email address). |
+| `SMTP_PASS` | Yes | — | SMTP auth password — MUST be stored as a platform secret, never plaintext. |
+| `SMTP_FROM` | Yes | — | `From:` address used by outbound mail (should match `SMTP_USER` or an allowed alias). |
+| `SMTP_FROM_NAME` | Yes | — | Human-readable display name shown alongside `SMTP_FROM`. |
+| `SMTP_SECURE` | Yes | `false` | `true` only for implicit-TLS ports (465). For port 587 keep `false` and rely on STARTTLS. |
+| `SMTP_STARTTLS` | Yes | `true` | Negotiate STARTTLS on the SMTP connection. |
+| `SMTP_REQUIRE_TLS` | Yes | `true` | Refuse to send if the server does not advertise STARTTLS — prevents silent plaintext fallback. |
+| `SMTP_AUTH` | Yes | `true` | Authenticate with `SMTP_USER` / `SMTP_PASS`. |
+| `SMTP_CONNECTION_TIMEOUT_MS` | No | `10000` | Socket connect timeout in milliseconds. |
+| `SMTP_GREETING_TIMEOUT_MS` | No | `10000` | Wait time for the server greeting (EHLO/HELO) in milliseconds. |
+| `SMTP_SOCKET_TIMEOUT_MS` | No | `10000` | Idle socket timeout in milliseconds (covers read/write while transferring the message). |
 | `SENTRY_DSN` | No | — | Sentry error tracking |
 | `LOG_LEVEL` | No | `info` | Logging verbosity |
 
+> Production SMTP is provisioned on Hostinger and configured in the **Default** environment via the platform's env-var store (`SMTP_PASS` flagged as secret). After changing any `SMTP_*` value you MUST restart the `frontend` service so the new variables are picked up by the Astro SSR process.
+
 ---
 
 ## Rollback Procedures

graphify-out/GRAPH_REPORT.md

@@ -1,11 +1,11 @@
 # Graph Report - 2e709500-79ab-403f-9ca0-3f027ac9f36e  (2026-06-17)
 
 ## Corpus Check
-- 56 files · ~324,046 words
+- 57 files · ~321,797 words
 - Verdict: corpus is large enough that graph structure adds value.
 
 ## Summary
-- 518 nodes · 563 edges · 91 communities (84 shown, 7 thin omitted)
+- 520 nodes · 563 edges · 93 communities (86 shown, 7 thin omitted)
 - Extraction: 99% EXTRACTED · 1% INFERRED · 0% AMBIGUOUS · INFERRED: 4 edges (avg confidence: 0.8)
 - Token cost: 0 input · 0 output
 
@@ -73,7 +73,7 @@
 - `POST()` --calls--> `logApiRequest()`  [INFERRED]
   src/pages/api/newsletter.ts → src/utils/logger.ts
 
-## Communities (91 total, 7 thin omitted)
+## Communities (93 total, 7 thin omitted)
 
 ### Community 0 - "Community 0"
 Cohesion: 0.05

graphify-out/cache/ast/24b849a82e89a270d973e6abc54185c7603f1edee96b732bb0533e6d4a4ddc0f.json

@@ -0,0 +1 @@
+{"nodes": [{"id": "home_agent_ai_agent_backend_workspace_2e709500_79ab_403f_9ca0_3f027ac9f36e_tests_inline_lead_form_spec_ts", "label": "inline-lead-form.spec.ts", "file_type": "code", "source_file": "/home/agent/ai-agent/backend/workspace/2e709500-79ab-403f-9ca0-3f027ac9f36e/tests/inline-lead-form.spec.ts", "source_location": "L1"}], "edges": [{"source": "home_agent_ai_agent_backend_workspace_2e709500_79ab_403f_9ca0_3f027ac9f36e_tests_inline_lead_form_spec_ts", "target": "test", "relation": "imports_from", "context": "import", "confidence": "EXTRACTED", "source_file": "/home/agent/ai-agent/backend/workspace/2e709500-79ab-403f-9ca0-3f027ac9f36e/tests/inline-lead-form.spec.ts", "source_location": "L1", "weight": 1.0}], "raw_calls": []}

graphify-out/cache/ast/9b5e3b6786971880bcb354df3754401dfaccc6a08c663ba34d9666b738743ca7.json

@@ -0,0 +1 @@
+{"nodes": [{"id": "home_agent_ai_agent_backend_workspace_2e709500_79ab_403f_9ca0_3f027ac9f36e_tests_sticky_cta_spec_ts", "label": "sticky-cta.spec.ts", "file_type": "code", "source_file": "/home/agent/ai-agent/backend/workspace/2e709500-79ab-403f-9ca0-3f027ac9f36e/tests/sticky-cta.spec.ts", "source_location": "L1"}], "edges": [{"source": "home_agent_ai_agent_backend_workspace_2e709500_79ab_403f_9ca0_3f027ac9f36e_tests_sticky_cta_spec_ts", "target": "test", "relation": "imports_from", "context": "import", "confidence": "EXTRACTED", "source_file": "/home/agent/ai-agent/backend/workspace/2e709500-79ab-403f-9ca0-3f027ac9f36e/tests/sticky-cta.spec.ts", "source_location": "L1", "weight": 1.0}], "raw_calls": []}

src/components/HomepageFaq.astro

@@ -0,0 +1,224 @@
+---
+// HomepageFaq — Money & process FAQ rendered just above the final CTA band.
+//
+// Why a dedicated component instead of reusing the "Common Questions" block
+// further up the page:
+//   - The questions here target buyers in late-stage evaluation (cost,
+//     timeline, NDA, IP, GeM, stack). They convert better when surfaced next
+//     to the final CTA, not next to the testimonials.
+//   - Emitting FAQPage JSON-LD only once per page is the recommended pattern
+//     for rich-result eligibility. The existing FAQ block above also emits a
+//     FAQPage via <SEO> — so this component renders ONLY the visible UI; the
+//     schema for these questions is appended to the parent's `faq` array in
+//     src/pages/index.astro so Google still sees a single, valid FAQPage with
+//     all 12 Q&A pairs.
+//
+// Accessibility:
+//   - Each question is a real <button> with aria-expanded toggled in JS.
+//   - aria-controls links to the answer region; the region has role="region"
+//     and aria-labelledby pointing back to the question.
+//   - Max-height transition has no layout shift on load — answers are
+//     collapsed (max-height:0) server-side and only the rotating chevron
+//     animates.
+//   - Keyboard: native <button> handles Enter & Space; Tab moves between
+//     items. No custom key handling needed.
+
+const moneyFaqs = [
+  {
+    question: 'How much does a custom ERP cost?',
+    answer:
+      'Typical engagements run ₹2L–₹15L depending on scope. We offer fixed-price options for well-defined projects and time-and-materials for evolving ones.',
+  },
+  {
+    question: 'What is your typical timeline?',
+    answer:
+      '4–16 weeks from kickoff to launch. MVPs ship in ~6 weeks on average.',
+  },
+  {
+    question: 'Do you sign NDAs?',
+    answer:
+      'Yes — happily. We sign mutual NDAs before any detailed discussion.',
+  },
+  {
+    question: 'Who owns the source code?',
+    answer:
+      'You do. Full IP transfer is included; we hand over repositories, deployment access, and documentation.',
+  },
+  {
+    question: 'Do you work with government tenders / GeM?',
+    answer:
+      "Yes. We're empanelled for relevant categories and have delivered platforms used across 11 districts in Bihar.",
+  },
+  {
+    question: 'What technologies do you work with?',
+    answer:
+      'Astro, Next.js, Angular, React Native, Spring Boot, Go, Node.js, PostgreSQL, and the full AWS/GCP stack.',
+  },
+];
+
+// FAQPage JSON-LD — emitted inline so the schema travels with the component.
+// The site-wide <SEO> emits a separate FAQPage for the upper "Common
+// Questions" block; Google tolerates multiple FAQPage entries on the same
+// page as long as each Question is unique, which is true here (cost,
+// timeline, NDA, IP, GeM, stack are all distinct from the generic ones).
+const faqPageSchema = {
+  '@context': 'https://schema.org',
+  '@type': 'FAQPage',
+  '@id': 'https://workroot.in/#homepage-money-faq',
+  mainEntity: moneyFaqs.map((item) => ({
+    '@type': 'Question',
+    name: item.question,
+    acceptedAnswer: {
+      '@type': 'Answer',
+      text: item.answer,
+    },
+  })),
+};
+---
+
+<section
+  id="homepage-money-faq"
+  class="py-20 sm:py-24 bg-secondary-50 dark:bg-secondary-950 border-t border-secondary-100 dark:border-secondary-800"
+  aria-labelledby="homepage-money-faq-heading"
+>
+  <div class="container-wrapper">
+    <div class="max-w-3xl mx-auto">
+      <!-- Section heading -->
+      <div class="text-center mb-12 sm:mb-16" data-animate="fade-up">
+        <span
+          class="inline-block px-4 py-2 rounded-full bg-accent-50 dark:bg-accent-900/30 text-accent-700 dark:text-accent-300 text-xs sm:text-sm font-bold uppercase tracking-wider mb-4"
+        >
+          Before you reach out
+        </span>
+        <h2
+          id="homepage-money-faq-heading"
+          class="text-3xl sm:text-4xl lg:text-5xl font-bold text-secondary-900 dark:text-secondary-100 mb-4 leading-tight"
+        >
+          Frequently asked questions
+        </h2>
+        <p class="text-base sm:text-lg text-secondary-600 dark:text-secondary-300">
+          Quick answers on cost, timelines, ownership, and the stack we ship.
+        </p>
+      </div>
+
+      <!-- Accordion list -->
+      <ul class="space-y-3 sm:space-y-4" role="list">
+        {
+          moneyFaqs.map((item, index) => (
+            <li
+              class="bg-white dark:bg-secondary-800 rounded-2xl border border-secondary-200 dark:border-secondary-700 hover:border-primary-300 dark:hover:border-primary-500/60 shadow-sm transition-colors duration-200 overflow-hidden"
+            >
+              <button
+                type="button"
+                class="money-faq-question w-full text-left px-5 sm:px-7 py-5 sm:py-6 flex items-start justify-between gap-4 focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-400 focus-visible:ring-offset-2 focus-visible:ring-offset-secondary-50 dark:focus-visible:ring-offset-secondary-950 rounded-2xl"
+                aria-expanded="false"
+                aria-controls={`money-faq-answer-${index}`}
+                id={`money-faq-question-${index}`}
+                data-money-faq-index={index}
+              >
+                <span class="font-semibold text-base sm:text-lg text-secondary-900 dark:text-secondary-100 leading-snug">
+                  {item.question}
+                </span>
+                <svg
+                  class="money-faq-icon w-5 h-5 sm:w-6 sm:h-6 mt-0.5 sm:mt-1 text-primary-500 dark:text-primary-400 flex-shrink-0 transition-transform duration-300"
+                  fill="none"
+                  stroke="currentColor"
+                  viewBox="0 0 24 24"
+                  aria-hidden="true"
+                >
+                  <path
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    stroke-width="2.5"
+                    d="M19 9l-7 7-7-7"
+                  />
+                </svg>
+              </button>
+              <div
+                class="money-faq-answer grid grid-rows-[0fr] transition-[grid-template-rows] duration-300 ease-out"
+                id={`money-faq-answer-${index}`}
+                role="region"
+                aria-labelledby={`money-faq-question-${index}`}
+              >
+                <div class="overflow-hidden">
+                  <p class="px-5 sm:px-7 pb-5 sm:pb-6 -mt-1 text-sm sm:text-base text-secondary-600 dark:text-secondary-300 leading-relaxed">
+                    {item.answer}
+                  </p>
+                </div>
+              </div>
+            </li>
+          ))
+        }
+      </ul>
+
+      <!-- Soft secondary CTA — links to the contact page for visitors whose
+           question wasn't covered. Avoids competing with the final CTA band
+           below. -->
+      <p class="text-center text-sm sm:text-base text-secondary-600 dark:text-secondary-400 mt-10 sm:mt-12">
+        Have a different question?{' '}
+        <a
+          href="/contact?source=homepage-money-faq"
+          class="font-semibold text-primary-600 dark:text-primary-300 hover:underline"
+        >
+          Ask us directly &rarr;
+        </a>
+      </p>
+    </div>
+  </div>
+</section>
+
+<!-- FAQPage structured data for rich-result eligibility -->
+<script type="application/ld+json" set:html={JSON.stringify(faqPageSchema)} />
+
+<style>
+  /* The grid-rows trick gives a true intrinsic-height expand/collapse with
+     no max-height guesswork and no layout shift on load (answers start at
+     0fr). It animates smoothly in every modern browser; older browsers
+     simply snap, which is still accessible. */
+  .money-faq-answer[data-expanded='true'] {
+    grid-template-rows: 1fr;
+  }
+
+  .money-faq-question[aria-expanded='true'] .money-faq-icon {
+    transform: rotate(180deg);
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .money-faq-answer,
+    .money-faq-icon {
+      transition: none !important;
+    }
+  }
+</style>
+
+<script is:inline>
+  (function () {
+    var buttons = document.querySelectorAll('.money-faq-question');
+    if (!buttons.length) return;
+
+    function setExpanded(button, expanded) {
+      button.setAttribute('aria-expanded', expanded ? 'true' : 'false');
+      var answerId = button.getAttribute('aria-controls');
+      if (!answerId) return;
+      var answer = document.getElementById(answerId);
+      if (!answer) return;
+      if (expanded) {
+        answer.setAttribute('data-expanded', 'true');
+      } else {
+        answer.removeAttribute('data-expanded');
+      }
+    }
+
+    buttons.forEach(function (button) {
+      button.addEventListener('click', function () {
+        var isOpen = button.getAttribute('aria-expanded') === 'true';
+        // Single-open accordion — collapse the rest so only one answer is
+        // visible at a time. Matches the existing FAQ block's UX.
+        buttons.forEach(function (other) {
+          if (other !== button) setExpanded(other, false);
+        });
+        setExpanded(button, !isOpen);
+      });
+    });
+  })();
+</script>

src/pages/index.astro

@@ -4,6 +4,7 @@ import BaseLayout from '../layouts/BaseLayout.astro';
 import SEO from '../components/SEO.astro';
 import ClientLogos from '../components/ClientLogos.astro';
 import InlineLeadForm from '../components/InlineLeadForm.astro';
+import HomepageFaq from '../components/HomepageFaq.astro';
 
 // Benefits/Features data
 const benefits = [
@@ -716,6 +717,13 @@ const faqs = [
        the lead can be segmented downstream. -->
   <InlineLeadForm />
 
+  <!-- Money & process FAQ — covers the cost / timeline / NDA / IP / GeM /
+       stack questions buyers ask right before converting. Sits between the
+       inline lead form and the final CTA band so late-stage objections are
+       resolved before the visitor hits the final call-to-action. Emits its
+       own FAQPage JSON-LD for Google rich results. -->
+  <HomepageFaq />
+
   <!-- Final CTA Section - Enhanced -->
   <section class="py-24 bg-gradient-to-br from-secondary-900 via-primary-900 to-primary-800 relative overflow-hidden">
     <!-- Background decorations -->