docs: update REVIEW.md with recent features, correct callback expiry, add CI skeleton notes

REVIEW.md

@@ -105,9 +105,10 @@ These survive redeploys because `booth_settings.json` lives in the persistent up
 - Runtime settings are stored in the persistent uploads volume (`booth_settings.json`).
 - The `booth_open` setting controls whether `/request` and `/kiosk` show the open banner or the closed banner.
 - Container cannot read host paths; all static assets used at runtime (logo, banners, QR code) must be in `static/` or a mounted volume.
-- The Hermes callback URL is signed with `APP_SECRET_KEY` and expires after 1 hour.
+- The Hermes callback URL is signed with `APP_SECRET_KEY` and expires after 7 days.
 - If you regenerate the Hermes API key, update the Hermes skill/config immediately; old key requests will 401.
 - New columns/tables are added via `models.py`. Use `/admin/settings` → **Fix Database Schema** after redeploying a schema change.
+- `__pycache__` and local `.env` files are already ignored by `.gitignore`; make sure they never get committed.
 
 ## How to redeploy
 
@@ -117,6 +118,11 @@ These survive redeploys because `booth_settings.json` lives in the persistent up
 
 ## Recent major additions
 
+- **Structured style dropdowns** — customer form now uses Decade / Basic / Additional style dropdowns instead of a free-text genre field. Values are stored as a comma-separated string in `style_genre`.
+- **Pronouns field** — required pronouns dropdown on the customer request form; stored in the `pronouns` column.
+- **Lyrics in delivery email** — final delivery email includes the generated lyrics in the same format as the player page.
+- **Delete uploaded songs** — admin request page can delete selected Version A / B uploads and reset the request to `prompt_ready`.
+- **Live queue kiosk slide** — `/kiosk` can cycle through QR, pricing, and active-queue slides based on `kiosk_cycle_seconds`.
 - **Cancelled status** — operators can mark any request as cancelled from the top of `/admin/request/<id>`.
 - **Revision history log** — each customer revision is recorded with revision count, note, and archived file names.
 - **Stems / Extras link** — operators paste a file-share link on the request page; customers see a download button after delivery.
@@ -126,6 +132,20 @@ These survive redeploys because `booth_settings.json` lives in the persistent up
 - **Music ZIP backup** — `/admin/settings` can download all uploaded MP3s as a ZIP.
 - **Database schema repair** — health check detects missing columns and tables and can repair them.
 
+## Project state notes
+
+- No `.gitlab-ci.yml` is currently in the repo; old pipeline records from an earlier CI config are still visible in GitLab but are not actionable because no runners are attached. Add a CI skeleton (see below) if you want automated checks back.
+- No automated tests exist yet.
+
+## CI skeleton (optional)
+
+A **CI skeleton** is the smallest GitLab CI config that gives you useful automated checks on every push without needing a heavy test suite. For this project it would be a `.gitlab-ci.yml` with one or two jobs:
+
+1. **Syntax check job** — install Python dependencies and run `python -m py_compile app.py models.py config.py init_db.py` to catch SyntaxErrors before they reach Portainer.
+2. **(Optional) Test job** — run a minimal pytest suite once tests are written. Right now this would be a placeholder that skips if no tests exist, so the pipeline stays green while you decide whether to add tests.
+
+It needs a GitLab runner to execute. Your GitLab instance has no runners attached, which is why the old pipelines are stuck/canceled. The skeleton just defines *what* to run; a runner is still required for it to actually execute.
+
 ## Static assets to keep in the repo
 
 - `static/Trollgorithm_booth.jpg` — open banner (request page and kiosk)