    if not camp or camp.user_id != user.id:
        raise HTTPException(status_code=404, detail="Recipient not found")
    attempts = (await db.execute(
        select(SendAttempt).where(SendAttempt.campaign_recipient_id == cr_id)
        .order_by(SendAttempt.id.asc()))).scalars().all()
    events = (await db.execute(
        select(EmailEvent).where(EmailEvent.campaign_recipient_id == cr_id)
        .order_by(EmailEvent.id.asc()))).scalars().all()
    return {
        "recipient": {
            "id": cr.id, "email": cr.email, "status": cr.status, "seq": cr.seq,
            "subject_id": cr.generated_subject_id, "template_id": cr.generated_template_id,
            "invoice_number": cr.generated_invoice_number,
            "amount": cr.generated_amount, "message_id": cr.message_id,
            "last_error": cr.last_error,
        },
        "attempts": [_ser_attempt(a) for a in attempts],
        "events": [{
            "id": e.id, "event_type": e.event_type, "detail": (e.detail or "")[:300],
            "message_id": e.message_id,
            "created_at": e.created_at.isoformat() if e.created_at else None,
        } for e in events],
    }
===
attachments.html
css
gmail-accounts.html
index.html
js
login.html
phones.html
recipients.html
send-test.html
settings.html
subjects.html
suppression.html
templates.html
===
- [x] A4. Security primitives: password hashing, JWT, CSRF, rate limiting, audit log, upload validation

## B. Core Backend
- [x] B1. Auth: user registration/login, Google OAuth 2.0 start/callback (state verification), token storage encrypted
- [x] B2. Gmail accounts manager: connect/test/reauthorize/disconnect (revoke tokens), Clear All, per-account limits
- [x] B3. Gmail JSON/client-config import + validation (no secrets exposed), never plaintext
- [x] B4. Recipients: manual/CSV/TXT import, validation (syntax, dupes, suppression, bounces), preview, max 2000
- [x] B5. Subject lines manager (CRUD, search, import/export, Clear All)
- [x] B6. HTML templates manager (paste/upload/editor/preview/duplicate/import/Clear All) + sanitization
- [x] B7. Variable engine (all %vars%, custom CSV columns, unknown-var warnings)
- [x] B8. Invoice number generator (configurable format, crypto-strong, collision check, per-campaign unique)
- [x] B9. Random financial generators (RandomTotal, RandomShippingCharge, admin-configurable ranges)
- [x] B10. Attachment system (types, HTML→PDF via WeasyPrint, unique filenames, malware-scan hook)
- [x] B11. Company phone numbers manager (manual/CSV, selection rule) → %CompanyPhone%
- [x] B12. Suppression list + unsubscribe flow (public tokenized link + POST /unsubscribe)
- [x] B13. Campaign wizard (12 steps) + preview endpoint rendering real messages
- [x] B14. Template sequencing modes (repeat/stop/random), subject rotation, account rotation (sequential/weighted, cooldown, per-account limits, auto-pause)

## C. Sending Engine
- [x] C1. Celery app + queue config, per-recipient jobs, rate limiting, retry/backoff, DLQ, pause/resume/cancel
- [x] C2. Real Gmail API send (OAuth2, MIME construction, message ID/thread ID capture) + OAuth2 SMTP alternative
- [x] C3. Status model: queued/submitted/accepted/temp_failed/perm_failed/suppressed/bounced — no fake success
- [x] C4. SSE live progress stream + campaign monitor endpoints
- [x] C5. Send Test Email flow with provider-confirmed results
- [x] C6. Campaign logs + CSV export

## D. Frontend
- [ ] D1. Layout, responsive CSS (13 nav pages), professional UI
- [ ] D2. Pages: Dashboard, Gmail Accounts, Recipients, Subject Lines, HTML Templates, Saved Templates, Attachments, Company Phones, Campaigns (wizard+monitor), Send Test, Logs, Suppression, Settings
- [ ] D3. Live progress via SSE, confirm dialogs for destructive ops

## E. Tests & Docs
- [ ] E1. pytest suite (OAuth, tokens, CSV/TXT, validation, variables, invoice gen, uniqueness, PDF, MIME, retry, rotation, clear-all, etc.)
- [ ] E2. Integration test gated on real Gmail credentials (skips otherwise)
- [ ] E3. Dockerfile, docker-compose (api/worker/postgres/redis), gunicorn/uvicorn prod config, HTTPS notes
- [ ] E4. README: Google Cloud OAuth setup, Gmail API setup, Postgres/Redis setup, workflow, compliance notes

## F. Verification & Delivery
- [ ] F1. Run full test suite + boot the app against real Postgres/Redis; verify endpoints/UI
- [ ] F2. Package source (zip) and deliver with docs
