@router.post("/validate-step")
async def validate_step(payload: dict, db: AsyncSession = Depends(get_db),
                        user: User = Depends(get_current_user)):
    """Wizard step validation between steps (step 3, 6, 9, 11 checks)."""
    step = int(payload.get("step", 0))
    data = payload.get("data", {})
    errors = []

    if step == 1:
        if not (data.get("name") or "").strip():
            errors.append("Campaign name is required")
    if step == 2:
        if not data.get("recipient_list_id"):
            errors.append("Select a recipient list")
    if step == 3:
        ids = data.get("subject_set_ids") or []
        if not ids:
            errors.append("Select at least one subject line")
        if len(ids) > cfg.MAX_SUBJECTS:
            errors.append(f"Max {cfg.MAX_SUBJECTS} subject variations")
        strategy = data.get("subject_rotation")
        if strategy not in VALID_ENUMS["subject_rotation"]:
            errors.append("Invalid subject rotation strategy")
=====
app/api/routers/auth.py:43:        httponly=True, samesite="lax", secure=(settings.ENVIRONMENT == "production"),
app/api/routers/auth.py:48:        httponly=False, samesite="lax", secure=(settings.ENVIRONMENT == "production"),