feat: UI polish sprint — 7 items + logs toolbar redesign (#365)

* feat: UI polish sprint — tag filters, toast tokens, logs toolbar, billing portal, editor UX

- Fleet: replace inline tag pills with multi-select combobox dropdown
- Toast: remap all notification colors to oklch design tokens
- Logs: convert floating hover toolbar to permanent pinned toolbar,
  replace all hardcoded colors with design tokens for theme support
- Audit: fix dropdown scroll-lock (modal=false), light theme button contrast
- Resources: remove redundant inner border/bg on tab wrapper
- Editor: add ⌘K/Ctrl+K shortcut hint and handler, standardize button heights
- Billing: signed Lemon Squeezy portal URLs via sencho.io proxy for all tiers
- New MultiSelectCombobox UI component

* feat(editor): replace button row with split-button dropdown

Replace three separate editor buttons (Discard, Save Only, Save & Deploy)
with a compact split-button dropdown. Primary action is "Save & Deploy";
chevron opens dropdown with "Save Only" and "Discard Changes" options.

backend/src/index.ts

@@ -1062,6 +1062,20 @@ app.post('/api/license/validate', async (_req: Request, res: Response): Promise<
   }
 });
 
+app.get('/api/license/billing-portal', async (_req: Request, res: Response): Promise<void> => {
+  try {
+    const url = await LicenseService.getInstance().getBillingPortalUrl();
+    if (!url) {
+      res.status(404).json({ error: 'No billing portal available. Ensure you have an active license.' });
+      return;
+    }
+    res.json({ url });
+  } catch (error) {
+    console.error('[License] Billing portal error:', error);
+    res.status(500).json({ error: 'Failed to retrieve billing portal URL' });
+  }
+});
+
 // --- Self-Update ---
 
 /** Respond 202 and trigger the "last breath" self-update after the response flushes. */

backend/src/services/LicenseService.ts

@@ -243,7 +243,7 @@ export class LicenseService {
             validUntil,
             trialDaysRemaining,
             instanceId,
-            portalUrl: db.getSystemState('customer_portal_url') || null,
+            portalUrl: db.getSystemState('billing_portal_url') || db.getSystemState('customer_portal_url') || null,
         };
     }
 
@@ -291,6 +291,13 @@ export class LicenseService {
             if (data.meta?.variant_name) {
                 db.setSystemState('license_variant_name', data.meta.variant_name);
             }
+            if (data.meta?.customer_id) {
+                db.setSystemState('customer_id', String(data.meta.customer_id));
+            }
+
+            // Clear any cached portal URL so it's refreshed on next request
+            db.setSystemState('billing_portal_url', '');
+            db.setSystemState('billing_portal_expires', '');
 
             console.log('[License] Activated successfully.');
             return { success: true };
@@ -345,6 +352,8 @@ export class LicenseService {
             'update_payment_url',
             'order_id',
             'receipt_url',
+            'billing_portal_url',
+            'billing_portal_expires',
         ];
         for (const key of keysToRemove) {
             db.setSystemState(key, '');
@@ -415,6 +424,9 @@ export class LicenseService {
             if (data.meta?.variant_name) {
                 db.setSystemState('license_variant_name', data.meta.variant_name);
             }
+            if (data.meta?.customer_id && !db.getSystemState('customer_id')) {
+                db.setSystemState('customer_id', String(data.meta.customer_id));
+            }
 
             console.log('[License] Validation successful.');
             return { success: true };
@@ -425,6 +437,53 @@ export class LicenseService {
         }
     }
 
+    /**
+     * Fetch a signed billing portal URL via the sencho.io proxy.
+     * Returns a pre-signed Lemon Squeezy Customer Portal URL (valid 24hrs).
+     * Caches the URL for 12 hours to reduce external API calls.
+     */
+    public async getBillingPortalUrl(): Promise<string | null> {
+        const db = DatabaseService.getInstance();
+        const status = db.getSystemState('license_status');
+        const licenseKey = db.getSystemState('license_key');
+
+        if (status !== 'active' || !licenseKey) {
+            return null;
+        }
+
+        // Check cache (12hr TTL)
+        const cachedUrl = db.getSystemState('billing_portal_url');
+        const cachedExpires = db.getSystemState('billing_portal_expires');
+        if (cachedUrl && cachedExpires && Date.now() < parseInt(cachedExpires, 10)) {
+            return cachedUrl;
+        }
+
+        try {
+            const response = await axios.post<{ url: string }>(
+                'https://sencho.io/api/billing-portal',
+                { license_key: licenseKey },
+                { timeout: 15000 }
+            );
+
+            const url = response.data?.url;
+            if (!url) {
+                return null;
+            }
+
+            // Cache for 12 hours
+            const ttl = 12 * 60 * 60 * 1000;
+            db.setSystemState('billing_portal_url', url);
+            db.setSystemState('billing_portal_expires', String(Date.now() + ttl));
+
+            return url;
+        } catch (err) {
+            console.warn('[License] Failed to fetch billing portal URL:', (err as Error).message);
+            // Return stale cache if available
+            if (cachedUrl) return cachedUrl;
+            return null;
+        }
+    }
+
     /**
      * Start periodic background validation every 72 hours.
      */