fix(idaa): add VPN/network hint, bump TTL to 12h, document server-side verify plan

- Classify persistent network/timeout failures as 'network_error' (separate from
  generic 'api_error') so the UI can show a targeted message
- Add actionable hint for members on hotel WiFi, VPN, or corporate networks:
  turn off VPN, switch to cellular, try a different network
- Extend VERIFIED_TTL_MS_DEFAULT from 45 min to 12 hours — covers a full workday
  so members at conferences do not need to re-verify mid-day
- Document planned server-side Novi verification FastAPI endpoint in
  CLIENT__IDAA_and_customized_mods.md (once implemented, eliminates client-side
  Cloudflare/IP-reputation exposure entirely)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/CLIENT__IDAA_and_customized_mods.md

@@ -220,6 +220,30 @@ These fields are read elsewhere in the IDAA UI to enable flows for verified user
 
 If you need a compact checklist for re-creating this flow in another integration, ask and I will add a small runbook with exact request/response field mappings.
 
+### Planned: Server-Side Novi Verification (FastAPI)
+
+**Problem:** The current implementation calls the Novi API client-side — from the member's browser directly to Novi. Hotel/conference WiFi, VPNs, corporate/hospital networks, and Cloudflare IP reputation filtering can block these calls and produce false "Access Denied" for legitimate members.
+
+**Solution:** A FastAPI endpoint proxies the Novi call server-to-server (Aether → Novi), caching results in Redis. Members' browser IPs are no longer in the call path.
+
+**Endpoint:** `GET /v3/action/idaa/novi_member/{uuid}`
+- Standard Aether auth headers required (`x-aether-api-key`, `x-account-id`)
+- Server reads `novi_idaa_api_key` / `novi_api_root_url` from site `cfg_json`
+- Redis cache key: `idaa:novi_member:{account_id}:{uuid}` — TTL 4 hours, only cache verified 200s
+
+**Response codes:**
+
+| Code | Meaning | Frontend action |
+|---|---|---|
+| `200` | Verified — `{ "verified": true, "full_name": "...", "email": "..." }` | Grant access |
+| `404` | UUID not in Novi (genuine non-member) | Deny access |
+| `429` | Novi rate limited | Show retry UI (not a denial) |
+| `503` | Novi unreachable | Show retry UI (not a denial) |
+
+**Frontend change when implemented:** Replace the direct `fetch()` to Novi in `verify_novi_uuid()` with a call to this endpoint via `ae_api`. The `api_key` param becomes unused (server holds it). Response code mapping: 404 → denied, 429 → `'rate_limited'`, 503 → `'api_error'`.
+
+**FastAPI task:** Tracked in `aether_api_fastapi/documentation/TODO__Agents.md` under "IDAA: Server-Side Novi Verification".
+
 ### Permission Levels (Ascending)
 | Level | Condition | Access |
 |---|---|---|