Aug 27 - Update free-plan gate, MFA is no longer bypassable via the app

app/routes/issues.py

@@ -1388,6 +1388,20 @@ def export_pdf(issue_id):
 
 
 # ── Vendor work order dispatch (phase36) ─────────────────────────────────────
+#
+# NOT LINKED FROM THE UI (Aug 2026). The "Contractor Work Orders" card was
+# removed from the issue detail page, so nothing posts here any more. The
+# endpoint is kept deliberately rather than deleted:
+#
+#   * it is the ONLY way to create a work order, so removing it would strand
+#     the public contractor pages (/work-orders/<token>), the model, the email
+#     template and the phase36 migration — a whole feature, not dead code;
+#   * tests/test_work_orders.py drives the end-to-end flow through it.
+#
+# To bring the feature back, restore the card in templates/issues/view.html —
+# nothing here needs to change. To retire it for good, remove this route, the
+# work_orders blueprint, its templates, the model and those tests together,
+# and only once no tokenized links are still outstanding with contractors.
 
 @bp.route('/<int:issue_id>/work-order', methods=['POST'])
 @login_required