What's configurable

Where	What you decide
`BILLABLE_STATUSES`, `STRIPE_METER_EVENT_NAME` in `metering.ts`	Which event statuses get billed, and your Stripe meter event name
`ANONYMOUS_RATE_LIMITS` in `anonymous-limits.ts`	Rate limits for unauthenticated traffic
Subscription status handling in `webhooks.ts`	Which Stripe statuses map to canceled versus active access
`SESSION_DURATION_SECONDS` in `session.ts`	How long a dashboard session lasts before re-login
Rotation grace period in `api-key.ts`	How long an old API key stays valid after rotation
`PLANS`, `PLAN_RATE_LIMITS` in `seed.ts`	Your actual plan quotas and limits
Email editing in dashboard settings	Not implemented in v1, it needs a re-verification flow

Change these before you seed#

PLANS and PLAN_RATE_LIMITS are read by npm run db:seed. Editing them after seeding means migrating rows, so set your tiers first. See quickstart step 4.