docs(prospecting): add scoring, database, and research docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/modules/prospecting/research-findings.md

@@ -0,0 +1,80 @@
+# .lu Domain Lead Generation — Research Findings
+
+Research on data sources, APIs, legal requirements, and cost analysis for the prospecting module.
+
+## 1. Data Sources for .lu Domains
+
+The official .lu registry (DNS-LU / RESTENA) does **not** publish zone files. All providers use web crawling to discover domains, so no list is 100% complete. Expect 70-80% coverage.
+
+### Providers
+
+| Provider | Domains | Price | Format | Notes |
+|----------|---------|-------|--------|-------|
+| NetworksDB | ~70,000 | $5 | Zipped text | Best value, one-time purchase |
+| DomainMetaData | Varies | $9.90/mo | CSV | Daily updates |
+| Webatla | ~75,000 | Unknown | CSV | Good coverage |
+
+## 2. Technical APIs — Cost Analysis
+
+### Technology Detection
+
+| Service | Free Tier | Notes |
+|---------|-----------|-------|
+| CRFT Lookup | Unlimited | Budget option, includes Lighthouse |
+| Wappalyzer | 50/month | Most accurate |
+| WhatCMS | Free lookups | CMS-only |
+
+**Approach used**: Custom HTML parsing for CMS, JS framework, analytics, and server detection (no external API dependency).
+
+### Performance Audits
+
+PageSpeed Insights API — **free**, 25,000 queries/day, 400/100 seconds.
+
+### SSL Checks
+
+Simple HTTPS connectivity check (fast). SSL Labs API available for deep analysis of high-priority leads.
+
+### WHOIS
+
+Due to GDPR, .lu WHOIS data for private individuals is hidden. Only owner type and country visible. Contact info scraped from websites instead.
+
+## 3. Legal — Luxembourg & GDPR
+
+### B2B Cold Email Rules
+
+Luxembourg has **no specific B2B cold email restrictions** per Article 11(1) of the Electronic Privacy Act (applies only to natural persons).
+
+**Requirements**:
+1. Identify yourself clearly (company name, address)
+2. Provide opt-out mechanism in every email
+3. Message must relate to recipient's business
+4. Store contact data securely
+5. Only contact businesses, not private individuals
+
+**Legal basis**: Legitimate interest (GDPR Art. 6(1)(f))
+
+### GDPR Penalties
+
+Fines up to EUR 20 million or 4% of global revenue for violations.
+
+**Key violations to avoid**:
+- Emailing private individuals without consent
+- No opt-out mechanism
+- Holding personal data longer than necessary
+
+### Recommendation
+
+- Focus on `info@`, `contact@`, and business role emails
+- Always include unsubscribe link
+- Document legitimate interest basis
+
+## 4. Cost Summary
+
+| Item | Cost | Type |
+|------|------|------|
+| Domain list (NetworksDB) | $5 | One-time |
+| PageSpeed API | Free | Ongoing |
+| Contact scraping | Free | Self-hosted |
+| Tech detection | Free | Self-hosted |
+
+Working MVP costs under $25 total.