Backend for React AI writing app — Supabase/Firebase + Stripe + Claude API

OVERVIEW I'm building Inkora, a subscription web app: an AI creative-writing companion for fiction (romance, fan fiction, poetry, general fiction). The React front-end is COMPLETE and will be provided, with clearly marked integration points. I need the backend built, connected, and the full app deployed. This is an 18+ platform with content safeguards. STACK ALREADY IN PLACE - React front-end (provided; single-file app ready to be scaffolded into a project) - GitHub (repo will live on my account) - Vercel (hosting, my account) - Stripe account created - Anthropic (Claude) API key — must live server-side only, never in client code - Domain: inkora.com SCOPE OF WORK 1. Secure AI endpoint — a serverless endpoint (e.g. POST /api/write) that attaches the provided system prompt, calls the Claude API with the server-side key, and returns the text to the front-end. Suggested writing model: claude-sonnet-4-6. 2. Content moderation — screen user input BEFORE the model call and model output AFTER it. Block sexually explicit content and gratuitous graphic gore. Use a inexpensive-model screen (e.g. Haiku) or a third-party moderation API. Log violations; support a warn-then-suspend flow. 3. Auth — your recommendation (Supabase or Firebase preferred). Email + password baseline; Google sign-in if low effort. 4. Database — persist each user's stories (title, genre, full message history, timestamps), characters, and notes. The front-end already models these data shapes. The story's full saved history must be sent with each AI request (this powers in-story continuity). 5. Subscriptions (Stripe) — $10/month, ~$27/quarter, ~$96/year. Free tier: 10 messages per day (make this a config value), resetting every 24h. Gate writing access by subscription status / remaining free allowance. Handle the subscription lifecycle via webhooks. 6. Age-gate persistence — the front-end collects date of birth + an 18+ affirmation; store the affirmation timestamp with the account. Structure it so a third-party age-verification provider can be swapped in later without reworking the flow. I'm open to building on a proven starter/template (e.g. the Vercel AI chatbot template) if it speeds things up — adapting solid existing code is welcome. DELIVERABLES - Deployed, working app (provided front-end + your backend) on my Vercel, repo on my GitHub - All secrets configured as environment variables (never in client code) - Short handoff notes: key rotation, where moderation logs live, how to change config values WHAT I PROVIDE - Complete front-end code, a written backend brief, and the system prompt (shared privately with the selected freelancer) - All accounts (GitHub, Vercel, Stripe, Anthropic) already created and ready TO APPLY, PLEASE ANSWER THESE IN YOUR PROPOSAL: 1. Have you wired Stripe subscriptions with webhooks before? Link or example. 2. How will you keep the API key off the client? 3. How would you implement input + output moderation cost-effectively? 4. Have you deployed serverless APIs on Vercel? 5. Your fixed quote and timeline for this scope. Proposals that don't answer these questions will not be considered.