The success/error banners (e.g. "Check your email for a link") were
dismissing after only 3 seconds, too quick to read comfortably.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- .gitattributes + an explicit allow-list in build-release.ps1 assemble a
  clean release tree (app/, core/, public/, scripts/, db/migrations only) -
  anything not on the allow-list is deleted from the deploy, so a stray
  file added later can't ship to production by accident.
- public/web.config.production.template holds the production appSettings
  (DB path outside the deploy dir, Environment=Production, error logging on).
- deploy-iis.ps1 builds, zips, and scp's a release to the IIS host, then
  runs deploy-iis-remote-apply.ps1 there over ssh to swap in the new files,
  run migrations, and restart the site/app pool - the DB and error log live
  outside the deploy directory so a redeploy never touches them.
- Removed deploy-iis-git.ps1 and migrate_isbusiness_to_households.vbs,
  leftovers from a different template project that didn't apply here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- Implement Election Materials order-form revisions (docs/lucid *(2).pdf):
  new "permanent ballot list" question, and a Yes/No/Unsure nonprofit-status
  question now asked on both blue-envelope permit-ownership branches, with
  a matching migration, model/repository regen, and validation updates.
- Box the /request-order form and heading in the site's form-panel style.
- Shrink the site footer.
- After request-order and order submission, redirect to / with a flash
  message instead of re-rendering the form page inline.
- Skin the continuation and order-confirmation emails to match the site's
  branding (logo, navy header/footer, purple accents) instead of plain
  unstyled HTML.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- Blue AV Envelope: City of permit holder and Permit Number are now always
  collected for an own-organization permit, regardless of nonprofit status -
  a permit lookup using only the nonprofit authorization code doesn't work,
  so the code is now additional info when nonprofit status is Yes, not a
  replacement for city/permit number.
- Order confirmation email header simplified to "KCI Purple Envelope Order
  Confirmation" text, dropping the site's PE logo mark and tagline.
- Replaced the IsValidJurisdictionNumber stub (previously always returned
  true) with real validation against JurisdictionApiUrl, cached in
  Application scope (JurisdictionCacheMinutes, default 60) since the
  jurisdiction list is essentially static reference data. Falls back to
  stale cached data on a refresh failure rather than blocking order
  requests; fails open only when there's no cache at all.

  Hit two Classic ASP gotchas along the way: Scripting.Dictionary can't be
  stored in Application scope (ASP 0197, apartment-threaded COM object) -
  cached a delimited string instead - and the codebase's generic aspJSON
  parser took 43s to parse the ~1500-record API response, so switched to a
  targeted regex extraction of just the JCode field (~1s).

RouteKit Classic ASP MVC starter for the Purple Envelope election-materials
order site: request-order flow, token-based order continuation, SurveyJS
order-details form with server-side validation and a themed confirmation
email, plus the framework core, generators, and dev-only aspunit test harness.