Production-ready: auth hardening, SSE fix, security polish, conflict resolution

[KafKafrnZ]

Summary

• Auth hardening: CSRF middleware, JWT refresh token rotation, fetchWithRefresh() wired into all 5 authenticated pages + tutor streaming
• SSE fix: AI Tutor was showing "No response received" — SSE parser was silently dropping all tokens from plain-string sse-starlette streams; fixed to treat non-JSON payloads as raw tokens
• Practice page fix: <Environment preset="night"> was fetching dikhololo_night_1k.hdr from CDN (failed in local dev / offline); replaced with equivalent manual lighting
• Security polish (from PR fix: frontend security polish — CSP, XSS sanitization, accessibility, password strength #22): rehype-sanitize XSS protection on ReactMarkdown, 4-rule password strength meter (includes special char), htmlFor/aria-live accessibility, Content-Security-Policy header
• Merge conflict resolution: Resolved 16 conflicts from enterprise audit PR fix: enterprise audit — critical & high severity fixes #21 — kept router-based main.py, merged vercel.json (security + cache headers combined), our proxy.ts with /explore protection
• 10-gap audit (P-D1→P-D10): structured error codes, pool pre-ping, OG/Twitter metadata, PWA PNG icons, Sentry guards, DEPLOY.md, README.md accuracy fixes, SECURITY.md disclosure link
• Test fixes: proxy-auth tests now use valid JWT-format tokens (plain strings fail isTokenExpired()); SSE parser tests updated for raw-token fallback behaviour

What changed

Area	Change
frontend/lib/sse.ts	Raw string payloads returned as {token} instead of {error}
frontend/components/ui/Blackhole.tsx	Removed CDN HDR environment; manual scene lights
frontend/app/api/[...path]/route.ts	Strip Expect header (Node v24 undici); AbortSignal.timeout(55000)
frontend/proxy.ts	/explore protected; isTokenExpired() JWT expiry check
frontend/vercel.json	Security headers + static asset cache headers merged
backend/app/core/auth.py	hashlib SHA-256 refresh token hashing; secrets generation
backend/app/core/config.py	.env.local takes precedence over .env
backend/app/core/error_handler.py	Structured api_error() format + client IP in rate-limit logs
backend/app/main.py	Clean 94-line router-based entrypoint (dropped 900-line monolith)
backend/railway.toml	healthcheckTimeout=30 for fastembed warmup

Test plan

• Backend: 69 tests pass (pytest backend/tests/ -q)
• Frontend: 35 tests pass (npm test -- --run)
• Manual: sign up → sign in → open Tutor → send a message (should get streamed response)
• Manual: navigate to Practice page (should load without HDR fetch error)
• Manual: navigate to /explore without auth (should redirect to /login)

Reviewer notes

• PR fix: frontend security polish — CSP, XSS sanitization, accessibility, password strength #22 (fix/frontend-polish-security) has been fully cherry-picked into this branch (commit a45c4d6) and can be closed
• gh CLI not authenticated in local dev — close PR fix: frontend security polish — CSP, XSS sanitization, accessibility, password strength #22 manually on GitHub

🤖 Generated with Claude Code