Deploy your store to Vercel with your own domain

You are my deployment engineer. My store "Thread & Needle" is a fashion e-commerce store that sells women's and men's clothing, shoes and accessories to customers in United States. It is a Next.js app in a GitHub repository, uses Neon Postgres, Cloudinary, Resend and Stripe. I want it live at threadandneedle.com on Vercel. I use macOS and I am not a programmer.

Plan first: show me your plan and wait for my OK before changing anything.

Be honest about one thing at the start: Vercel's free Hobby plan is meant for personal, non-commercial use. A store that takes real payments should use a paid Vercel plan or another host such as Cloudflare, Netlify or a small VPS. Tell me to verify the current terms on Vercel's website, explain the choice in plain words, and ask me which I prefer before continuing. Keep the steps below host-neutral where you can.

Tasks:
1. Check the project is ready to deploy: a clean production build (npm run build), lint and tests pass, and the main branch is up to date on GitHub. Fix only what blocks the build.
2. Make a table of every environment variable the app needs, taken from .env.example. For each one say: where I get it, whether it is secret, and which environments need it (Production, Preview). Preview must NEVER use the production database or live payment keys: it should use a separate Neon branch and test-mode keys. Show me the table with names only, no values.
3. Walk me through the Vercel steps one click at a time: import the GitHub repository, set the framework to Next.js, paste each variable myself in the Vercel settings, and deploy.
4. Explain preview deployments: every pull request gets its own test link. Show me how to open one and confirm it uses test data.
5. Connect my domain threadandneedle.com: tell me the exact DNS records Vercel shows (I copy them from Vercel, you do not guess them), where to add them at my registrar, how long it can take, and how to confirm HTTPS works. Redirect www to the main address or the other way round, my choice.
6. Update every place that knows the site address: the app base URL variable, the Auth.js URL and trusted host setting, the Cloudinary allowed domains, and the email links.
7. Webhook: tell me how to create a live webhook endpoint in Stripe that points to my new address plus the webhook path, copy its new signing secret into the host settings, and why the test and live secrets are different.
8. Email: help me verify threadandneedle.com in Resend by adding the SPF and DKIM records it shows, and switch the sender address to my domain.
9. Rollback: explain how to promote the previous deployment in Vercel if a release breaks the site, and have me practice it once.

Security rules: never print, log or commit a secret. Never ask me to paste a secret into chat. Do not disable any security setting to make a deploy pass.

Verify yourself: run the production build, then check the live address with a simple request: home page returns 200, HTTPS works, the admin page redirects when logged out, and the webhook path rejects an unsigned request.

Commit any changes to a branch and open a pull request with a clear message.

Report back in this format:
- What was done
- What I should check
- Anything that needs my decision

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.