Chore/dependency security audit

.claude/settings.json

@@ -6,7 +6,29 @@
       "Bash(JWT_SECRET=x JWT_REFRESH_SECRET=y MONGODB_URI=mongodb://localhost:27017 node -e ' *)",
       "Bash(node _smoke_userdata.js)",
       "Bash(node _smoke_email_send.js)",
-      "Bash(node _smoke_profile_upload.js)"
+      "Bash(node _smoke_profile_upload.js)",
+      "Bash(grep -i '\\\\.html$')",
+      "Bash(curl -s -o /dev/null -w \"backend health: %{http_code}\\\\n\" http://localhost:5000/api/v1/health)",
+      "Bash(curl -s -o /dev/null -w \"root: %{http_code}\\\\n\" http://localhost:5000/)",
+      "Bash(curl -s -o /dev/null -w \"/health: %{http_code}\\\\n\" http://localhost:5000/health)",
+      "Bash(curl -s -o /dev/null -w \"/api/v1: %{http_code}\\\\n\" http://localhost:5000/api/v1)",
+      "Bash(npx --yes playwright install --dry-run chromium)",
+      "Bash(cp /d/Upscaler-Frontend/src/styles/legacy-portal.css /c/Users/07kav/AppData/Local/Temp/claude/d--backend/10686d40-28ba-448e-825b-f09f4e650cc2/scratchpad/legacy-portal.css)",
+      "Bash(cp /d/Upscaler-Frontend/src/styles/theme-refined.css /c/Users/07kav/AppData/Local/Temp/claude/d--backend/10686d40-28ba-448e-825b-f09f4e650cc2/scratchpad/theme-refined.css)",
+      "Bash(cp /d/Upscaler-Frontend/src/styles/legacy-settings.css /c/Users/07kav/AppData/Local/Temp/claude/d--backend/10686d40-28ba-448e-825b-f09f4e650cc2/scratchpad/legacy-settings.css)",
+      "Read(//c/Users/07kav/AppData/Local/Temp/claude/d--backend/10686d40-28ba-448e-825b-f09f4e650cc2/scratchpad/**)",
+      "Bash(node inspect2.js)",
+      "Bash(node inspect3.js)",
+      "Bash(node inspect4.js)",
+      "Bash(node inspect5.js)",
+      "Bash(node scratch_make_roster.js)",
+      "Bash(rm scratch_make_roster.js)",
+      "Bash(node inspect7.js)",
+      "Bash(curl -s -o /dev/null -w \"proof file HTTP status: %{http_code}\\\\n\" \"http://localhost:5000/uploads/placement-proof/8c2b94e0-8854-46e4-840a-a45e11df4c27.png\")",
+      "Bash(node repro_login.js)",
+      "Bash(node repro_login2.js)",
+      "Bash(node repro_final_check.js)",
+      "Bash(gcloud config *)"
     ]
   }
 }

.env.compose.example

@@ -0,0 +1,34 @@
+# Copy to `.env` in this directory — docker compose reads it automatically.
+#   cp .env.compose.example .env
+#
+# JWT_SECRET and JWT_REFRESH_SECRET have no defaults on purpose: compose
+# refuses to start without them rather than booting with a guessable value.
+# Generate each with:  openssl rand -base64 48
+
+JWT_SECRET=
+JWT_REFRESH_SECRET=
+
+# Must be identical for node-api and ai-service (compose passes this one
+# variable to both). Generate the same way as above.
+AI_SERVICE_SHARED_SECRET=dev-only-shared-secret-change-me
+
+# Set to `production` to make ai-service refuse to boot while
+# AI_SERVICE_SHARED_SECRET is still the public default above.
+AI_SERVICE_ENV=development
+
+# Optional — AI features degrade gracefully (local fallback questions,
+# unmodified resume text) when this is unset.
+GROQ_API_KEY=
+
+# Optional — transactional email is skipped when unset.
+BREVO_API_KEY=
+BREVO_SENDER_EMAIL=
+BREVO_SENDER_NAME=UpScaler-AI
+
+MONGODB_DB_NAME=upscaler_ai_node
+CORS_ORIGINS=http://localhost:3000
+FRONTEND_URL=http://localhost:3000
+
+# Baked into the frontend bundle at BUILD time — this is what the browser
+# calls, so it must be reachable from the host, not a compose service name.
+NEXT_PUBLIC_API_URL=http://localhost:5000/api/v1

.git-blame-ignore-revs

@@ -0,0 +1,10 @@
+# Revisions listed here are skipped by `git blame`.
+# Enable locally with:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+# (GitHub reads this file automatically.)
+#
+# Only pure-formatting commits belong here — never anything that changes
+# behaviour, or blame will hide real changes.
+
+# style: apply black formatting across python-service
+d621b5ecc01bce9792e452fcc1c5d8a54bb34484