Detailed Security Audit + Hardening (Web Project)

Perform a comprehensive security hardening and SEO improvement pass 
on this codebase. Work through the sections below IN ORDER. After 
EACH numbered section, run npm run build and npm run lint before 
moving to the next section — if either fails, STOP and fix it before 
continuing. If any change in a later section would conflict with or 
require modifying logic from an earlier section, STOP and explain 
the conflict before proceeding.

=== SECTION 1: READ-ONLY AUDIT FIRST ===
Before changing anything, scan and report (with file/line references):
- Hardcoded secrets/passwords/fallback keys (JWT, admin password, 
  any revalidation/webhook secrets)
- Any auth bypass tied to NODE_ENV === 'development' (backend AND 
  frontend)
- Any public API endpoint (uploads, forms, admin-adjacent routes) 
  missing authentication
- Any middleware/proxy reading cookies/tokens without verifying 
  cryptographic signature
- Any raw/dynamic SQL query built from unsanitized user input
- Any OTP/token/secret written to plaintext local files
- Current rate limiting status on login and OTP endpoints (or 
  confirm "none")
- Outdated dependencies with known CVEs (npm audit)
- Current CSP/security headers status
- Whether session tokens are HttpOnly or JS-readable
- CORS configuration on sensitive endpoints
Show me this report before proceeding to Section 2.

=== SECTION 2: FIX CRITICAL/HIGH VULNERABILITIES ===
Based on Section 1 findings, fix:
- Require authentication on any unauthenticated sensitive endpoint
- Remove ALL development-mode auth bypasses (backend + frontend), 
  completely — no conditional shortcuts
- Fix any middleware that skips signature verification — use proper 
  JWT verify
- Fix SQL injection by whitelisting/parameterizing any dynamic query 
  inputs
- Remove plaintext file writes of OTPs/secrets; delete any existing 
  plaintext files
- Make JWT_SECRET, ADMIN_PASSWORD, and any other sensitive env vars 
  REQUIRED in production — throw a clear error if missing, no silent 
  guessable fallback

=== SECTION 3: LOGIN BRUTE-FORCE PROTECTION ===
- Create a failed_login_attempts table (ip_address, timestamp, 
  result), auto-cleaning entries older than 15 minutes
- 0-2 failed attempts: normal login
- 3-4 failed attempts: require Cloudflare Turnstile captcha before 
  checking password (use TURNSTILE_SECRET_KEY env var — tell me if 
  this isn't set yet so I can create it at dash.cloudflare.com first)
- 5+ failed attempts: full 15-minute lockout for that IP regardless 
  of correct credentials/captcha
- Apply the same attempt-limit pattern to OTP verification if OTP 
  login exists
- On lockout, send a security alert email via the existing email 
  service, with a 30-minute cooldown so repeated lockouts don't spam 
  the inbox
- Wrap all new logic in try/catch so failures never break the 
  existing login flow

=== SECTION 4: SECURITY LOG DASHBOARD ===
Create an admin-only page showing login attempt history: timestamp, 
IP, device/browser (user-agent), stage (password/OTP), result. Add 
filtering by result and search by IP. Auto-delete entries older than 
30 days. Must sit behind existing admin authentication, in the 
existing admin navigation.

=== SECTION 5: SECURITY HEADERS + CORS ===
Add CSP, X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, 
Strict-Transport-Security, Referrer-Policy in next.config.ts. Before 
finalizing the CSP whitelist, scan the codebase for every external 
script/embed ACTUALLY used (analytics, payment gateways, Turnstile, 
storage/CDN, fonts) and whitelist only those — do not include unused 
services, and do not break any existing functionality.

=== SECTION 6: HTTPONLY COOKIES (HIGHEST RISK — BE CAREFUL) ===
Migrate the session/auth token from client-readable storage 
(sessionStorage / non-HttpOnly cookies) to HttpOnly + Secure + 
SameSite=Lax cookies set server-side on login. Update session-check 
and logout logic to match. Any other API route currently expecting 
an Authorization header must continue working unchanged — inject the 
header from the cookie in middleware rather than rewriting those 
routes. Do not remove or weaken any existing authorization check 
while doing this.

=== SECTION 7: SEO — PER-PAGE METADATA ===
- Remove any hardcoded canonical: '/' in the root layout that forces 
  every page to canonicalize to the homepage
- Give every static page (about, privacy, terms, contact, etc.) and 
  every dynamic content page (blog/article) its own unique title, 
  meta description, and self-referencing canonical URL
- For blog/article posts: confirm SEO title/description/keyword 
  fields exist in the ACTUALLY-USED editor UI (not a disconnected/
  orphaned component) — if they only exist in unused code, add them 
  to the real editor
- Make these SEO fields auto-populate from the post's title and 
  summary/excerpt in real time, but stop auto-syncing a field the 
  moment the user manually edits it (so their manual changes are 
  never overwritten)

=== SECTION 8: BLOG EDITOR — TABLE PASTE SUPPORT ===
If the blog editor uses a custom plain-text-to-HTML parser, check 
whether it detects markdown tables. It likely only detects lines 
strictly starting/ending with "|". Add detection for tab-separated 
table content too (common when pasting rendered tables copied from 
AI chat interfaces like Claude/ChatGPT, which use tabs, not pipes, 
between cells). This must be purely additive — do not change any 
existing logic for headings (#), lists (-, *, 1.), bold (**), 
italic (*), links ([]()), or existing pipe-table parsing. Place the 
new check after those, so it never misfires on non-table content.

=== FINAL STEP ===
After all sections, give me:
1. A full list of every file changed, grouped by section
2. Confirmation that npm run build and npm run lint both pass
3. A manual test checklist covering: login (normal), login (3+ fails 
   → captcha), login (5+ fails → lockout + email), logout, session 
   persistence, security log page, homepage/page-source header check, 
   a static page's title/canonical in page source, blog post SEO 
   auto-fill, and pasting a table into the blog editor.