Gate Intercom launcher behind intercom_preview localStorage flag

[ngnijland]

Summary

• Wraps the entire Intercom bootstrap in src/layouts/components/Intercom.astro behind a intercom_preview localStorage check — replacing the previous hide_default_launcher-only gate so non-preview visitors don't load the widget at all.
• Paired with the same gate on the dashboard (teams.rocketsim.app) so we can dogfood the cross-subdomain identified handoff in production without exposing Messenger to every visitor.
• Opt in per browser: localStorage.setItem("intercom_preview", "true"). Remove the item to opt out. Once we're happy with the flow, a follow-up PR will drop the gate on both sides.

Paired change

Dashboard: https://github.com/AvdLee/LicenseKit/pull/670 — adds the verified-identity boot on teams.rocketsim.app, gated on the same flag.

Identified session lifetime

The cross-subdomain handoff is carried by Intercom's own cookies on .rocketsim.app. Defaults:

Cookie	Purpose	Default lifetime
intercom-session-<app_id>	Marks the visitor as having an active identified session — this anonymous boot reads it to surface the identified user	~7 days, rolling (refreshes on activity)
intercom-id-<app_id>	Visitor / contact ID	~9 months
intercom-device-id-<app_id>	Device ID	~9 months

Practically this means:

• Dashboard today → public site within ~7 days of dashboard activity: still recognized as the identified user.
• Dashboard today → public site 8+ days later with no dashboard activity in between: the session cookie has expired and the public site treats them as anonymous again. Intercom's backend still links them to the same contact record via the 9-month visitor ID (so agents see prior history), but Identity Verification is no longer live in Messenger.

Test plan

• In production, open rocketsim.app in a clean browser and confirm no Intercom script loads (no requests to widget.intercom.io).
• Run localStorage.setItem("intercom_preview", "true") in DevTools, reload, and confirm the Messenger launcher appears.
• With the preview flag also set on teams.rocketsim.app, log in there, then return to rocketsim.app and confirm the visitor is recognized as the identified user (not a fresh anonymous lead).
• localStorage.removeItem("intercom_preview"), reload, confirm Intercom disappears again.
• npm run lint && npm run format:check && npm run typecheck && npm run build && npm run knip — all pass locally.

🤖 Generated with Claude Code