docs: record successful production deploy of UX/SAAS redesign

docs/HANDOFF.md

@@ -24,7 +24,7 @@ filesystem JSON storage (no SQL). i18n TH/EN. No self-registration (admin provis
 - **user** (trainee) — trains against personas, own board.
 
 ## Current state — local code/security gate passed; production-operation gate pending
-> **2026-08-21:** UX/SAAS 12-point redesign (NOT yet pushed). Self-registration
+> **2026-08-21:** UX/SAAS 12-point redesign (**PUSHED + LIVE, verified 2026-08-21**). Self-registration
 > (`POST /api/auth/register`, role=user, first-created-user = super_admin), super_admin may now
 > promote others + is invisible to regular admin, user-created private product groups + admin
 > **สินค้าขององค์กร** (shared) with hidden/public visibility, analytics (team + per-user weak areas,
@@ -32,9 +32,10 @@ filesystem JSON storage (no SQL). i18n TH/EN. No self-registration (admin provis
 > docx/xlsx uploads, **persona→persona** copy, tabs **การฝึก → ผลการฝึก → ภาพรวม**, admin lands on
 > ภาพรวม / non-admin on การฝึก, guide in topbar, weak-areas merged into Results + my-personas into
 > Training, ดูรายงาน UI removed (endpoint kept). **348 backend tests pass, frontend build +
-> vitest clean.** See `docs/engineering-log/2026-08-21-ux-saas-redesign.md` +
-> `docs/plan-2026-08-21-ux-saas-redesign.md`. Deploy pending operator push (+ confirm default-org
-> env for self-register; previewMode vs hidden-group semantics to reconcile).
+> vitest clean.** Live-verified: new bundle served (`i18n-DU1-Z2I7.js`), `POST /api/auth/register`
+> → HTTP 400 (route live), backend up. See `docs/engineering-log/2026-08-21-ux-saas-redesign.md` +
+> `docs/plan-2026-08-21-ux-saas-redesign.md`. Before enabling public self-signup, confirm the
+> default-org env for register; reconcile previewMode vs hidden-group semantics.
 > **2026-08-20:** OAuth login/register (Google + Facebook) added. Public social signup into a
 > single default org (`OAUTH_DEFAULT_ORG`, role user, seat-checked); email-match links existing
 > users. Server-side token validation via stdlib urllib (no new dep; Google tokeninfo + Facebook