Lesson 5.7 · 45 minManual entry, import and export

Add four data features to the CRM: manual entry, CSV export, CSV import
with duplicate detection, and complete deletion of a lead.

Purpose: leads also arrive by phone and from old spreadsheets; the owner
must be able to take data out and to remove a person's data fully.

Context: docs/crm-spec.md, the lead list with its filters, the single
status-change function. Add these rules to the spec as "Data in and out".

1. Manual entry: an "Add lead" button on /admin/leads opening a form:
   name (required), email, phone (at least one of the two required),
   message, status (default new). Same validation rules as the public form.
   Saves with created_via = manual. Sends no notifications. A status other
   than new is recorded through the status function. If the duplicate rule
   below matches an existing lead, warn with a link; allow "Add anyway".

2. Export: an "Export CSV" button on /admin/leads that downloads every lead
   matching the current search and filters (all pages), with a header row
   and these columns: name, email, phone, message, status, created_at,
   created_via, and the stored source columns. UTF-8. Neutralise cells that
   a spreadsheet could run as a formula, following OWASP's CSV injection
   guidance; check that guidance rather than relying on memory.

3. Import: an "Import CSV" button. It accepts a file with the same columns
   as the export (only name plus email or phone are required; unknown
   columns are ignored), up to 1,000 rows.
   Duplicate rule, exactly: tidy emails by trimming and lowercasing; tidy
   phones by keeping digits only. If a row has an email, it is a duplicate
   when an existing lead has the same tidy email. If a row has no email, it
   is a duplicate when an existing lead has the same tidy phone. Rows
   earlier in the same file count as existing.
   First show a preview and change nothing: counts of new, duplicate and
   invalid rows, and a table giving for each duplicate the lead it matched
   and for each invalid row the reason. Only "Confirm import" writes.
   Duplicates are skipped, never merged or overwritten. New rows are saved
   with created_via = import, the status from the file if it is one of the
   five stages (otherwise new, with any non-new status recorded through the
   status function), and created_at from the file if valid (otherwise now).
   No notifications. Undo the export's formula neutralising, so an exported
   file imports back unchanged. Imported text is shown as plain text.

4. Delete: a "Delete lead" button on the lead card. The dialog states what
   will be deleted with counts (notes, tasks, history rows) and requires
   typing the lead's name. Deleting removes the lead and, through the
   cascade from the first CRM migration, its notes, tasks and history.
   Verify the cascade exists; if not, stop and tell me. Afterwards list
   where copies may remain: notification emails, Telegram messages,
   exported files, provider logs and backups.

Constraints: everything on the server for the signed-in owner only.

Before you report, verify in a real browser using the browser connection;
when the login page appears, wait while I sign in myself. Check and report
on each: a manual lead sends no notification; an export with a status
filter has as many rows as the list's total; importing that file unchanged
previews 0 new; after adding two new people, one row repeating an existing
email under a different name and one row with no email and an existing
phone spaced differently, the preview says 2 new and 2 more duplicates,
and confirming raises the lead total by exactly 2; deleting a lead with
notes, tasks and history leaves no rows for its id in any of the four
tables. Run the build. Say what you could not verify.