Maintain your store and keep growing it safely

You are my site maintainer. My store "Thread & Needle" is live at threadandneedle.com. It is a fashion e-commerce store that sells women's and men's clothing, shoes and accessories to customers in United States in USD, built with Next.js, Neon Postgres, Cloudinary, Resend and Stripe, hosted on Vercel, with code in GitHub. I am not a programmer and I use macOS.

Plan first: show me your plan and wait for my OK before changing anything.

Goal: make the store easy and safe to look after, and to grow, without breaking it.

Tasks, on a new branch:
1. Write MAINTENANCE.md in plain language with three routines.
   Weekly (30 minutes): check the uptime and error alerts, read the sales and order report from the admin panel, look for orders stuck unpaid or unshipped, check email bounces, and merge small dependency update pull requests only when tests pass.
   Monthly (1 hour): take a production backup and rehearse a restore into a scratch database, review who has admin access, rotate any key that was shared or might have leaked, run a security check, review free-tier usage on Vercel, Neon, Cloudinary and Resend (verify limits on each pricing page), and re-read the policy pages.
   After any big change: run the full test suite and a test purchase in test mode.
2. Add a command named "npm run health" that runs the checks the agent can do alone: lint, type check, unit tests, end-to-end tests, npm audit for known vulnerable packages, and a list of outdated packages. It must print a short summary in plain language with PASS or ATTENTION for each, and must not print secrets.
3. Add automatic dependency update pull requests (for example a Dependabot configuration for GitHub), grouped so I get few, small pull requests. Explain how to tell a safe update from a risky one (major updates need a test run and a look at the changelog). Never auto-merge.
4. Write FEATURE_WORKFLOW.md: the safe way to add anything new. Create a branch, ask the agent for a plan first, build in small commits, run npm run health, test on the Vercel preview link with test data, open a pull request, read the summary, merge only if checks pass, watch the site for 30 minutes, and roll back from Vercel if something breaks. Add three example features I could try next (discount codes, product reviews, wishlist), each with a one-line warning.
5. Add a short section "How to read your reports" explaining what to look at in the sales report, the traffic report and the error alerts, and what number changes should make me investigate.
6. Add REUSE_THIS_SERIES.md: how to build a different store with this series. Change the keywords at the top of the series, then create a new GitHub repository, Neon project, Cloudinary folder, Resend domain, Stripe account and fresh secrets. Never copy .env files, customer data or keys from this store. List which episodes can be skipped and which must be repeated.
7. Finish with a short wrap-up: what I now own, what it costs when free plans run out, and three risks to watch (payments, customer data, out-of-date packages).

Security rules: never print, log or commit a secret. Never auto-merge. Never run commands that delete data without asking me.

Verify yourself: run npm run health and show me the summary, and show that the Dependabot configuration file is valid.

Commit with a clear message such as "Add maintenance routines, health command and workflow guides" and open a pull request.

Report back in this format:
- What was done
- What I should check
- Anything that needs my decision

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.