Detailed Security Audit + Hardening (Web Project)

Perform a comprehensive security hardening and SEO improvement pass
on this codebase. Work through the sections below IN ORDER. After
EACH numbered section, run npm run build and npm run lint before
moving to the next section — if either fails, STOP and fix it before
continuing. If any change in a later section would conflict with or
require modifying logic from an earlier section, STOP and explain
the conflict before proceeding.

=== SECTION 1: READ-ONLY AUDIT FIRST ===
Before changing anything, scan and report (with file/line references):
- Hardcoded secrets/passwords/fallback keys (JWT, admin password,
any revalidation/webhook secrets)
- Any auth bypass tied to NODE_ENV === 'development' (backend AND
frontend)
- Any public API endpoint (uploads, forms, admin-adjacent routes)
missing authentication
- Any middleware/proxy reading cookies/tokens without verifying
cryptographic signature
- Any raw/dynamic SQL query built from unsanitized user input
- Any OTP/token/secret written to plaintext local files
- Current rate limiting status on login and OTP endpoints (or
confirm "none")
- Outdated dependencies with known CVEs (npm audit)
- Current CSP/security headers status
- Whether session tokens are HttpOnly or JS-readable
- CORS configuration on sensitive endpoints
Show me this report before proceeding to Section 2.

=== SECTION 2: FIX CRITICAL/HIGH VULNERABILITIES ===
Based on Section 1 findings, fix:
- Require authentication on any unauthenticated sensitive endpoint
- Remove ALL development-mode auth bypasses (backend + frontend),
completely — no conditional shortcuts
- Fix any middleware that skips signature verification — use proper
JWT verify
- Fix SQL injection by whitelisting/parameterizing any dynamic query
inputs
- Remove plaintext file writes of OTPs/secrets; delete any existing
plaintext files
- Make JWT_SECRET, ADMIN_PASSWORD, and any other sensitive env vars
REQUIRED in production — throw a clear error if missing, no silent
guessable fallback

=== SECTION 3: LOGIN BRUTE-FORCE PROTECTION ===
- Create a failed_login_attempts table (ip_address, timestamp,
result), auto-cleaning entries older than 15 minutes
- 0-2 failed attempts: normal login
- 3-4 failed attempts: require Cloudflare Turnstile captcha before
checking password (use TURNSTILE_SECRET_KEY env var — tell me if
this isn't set yet so I can create it at dash.cloudflare.com first)
- 5+ failed attempts: full 15-minute lockout for that IP regardless
of correct credentials/captcha
- Apply the same attempt-limit pattern to OTP verification if OTP
login exists
- On lockout, send a security alert email via the existing email
service, with a 30-minute cooldown so repeated lockouts don't spam
the inbox
- Wrap all new logic in try/catch so failures never break the
existing login flow

=== SECTION 4: SECURITY LOG DASHBOARD ===
Create an admin-only page showing login attempt history: timestamp,
IP, device/browser (user-agent), stage (password/OTP), result. Add
filtering by result and search by IP. Auto-delete entries older than
30 days. Must sit behind existing admin authentication, in the
existing admin navigation.

=== SECTION 5: SECURITY HEADERS + CORS ===
Add CSP, X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff,
Strict-Transport-Security, Referrer-Policy in next.config.ts. Before
finalizing the CSP whitelist, scan the codebase for every external
script/embed ACTUALLY used (analytics, payment gateways, Turnstile,
storage/CDN, fonts) and whitelist only those — do not include unused
services, and do not break any existing functionality.

=== SECTION 6: HTTPONLY COOKIES (HIGHEST RISK — BE CAREFUL) ===
Migrate the session/auth token from client-readable storage
(sessionStorage / non-HttpOnly cookies) to HttpOnly + Secure +
SameSite=Lax cookies set server-side on login. Update session-check
and logout logic to match. Any other API route currently expecting
an Authorization header must continue working unchanged — inject the
header from the cookie in middleware rather than rewriting those
routes. Do not remove or weaken any existing authorization check
while doing this.

=== SECTION 7: SEO — PER-PAGE METADATA ===
- Remove any hardcoded canonical: '/' in the root layout that forces
every page to canonicalize to the homepage
- Give every static page (about, privacy, terms, contact, etc.) and
every dynamic content page (blog/article) its own unique title,
meta description, and self-referencing canonical URL
- For blog/article posts: confirm SEO title/description/keyword
fields exist in the ACTUALLY-USED editor UI (not a disconnected/
orphaned component) — if they only exist in unused code, add them
to the real editor
- Make these SEO fields auto-populate from the post's title and
summary/excerpt in real time, but stop auto-syncing a field the
moment the user manually edits it (so their manual changes are
never overwritten)

=== SECTION 8: BLOG EDITOR — TABLE PASTE SUPPORT ===
If the blog editor uses a custom plain-text-to-HTML parser, check
whether it detects markdown tables. It likely only detects lines
strictly starting/ending with "|". Add detection for tab-separated
table content too (common when pasting rendered tables copied from
AI chat interfaces like Claude/ChatGPT, which use tabs, not pipes,
between cells). This must be purely additive — do not change any
existing logic for headings (#), lists (-, , 1.), bold (),
italic (), links ([]()), or existing pipe-table parsing. Place the
new check after those, so it never misfires on non-table content.

=== FINAL STEP ===
After all sections, give me:
1. A full list of every file changed, grouped by section
2. Confirmation that npm run build and npm run lint both pass
3. A manual test checklist covering: login (normal), login (3+ fails
→ captcha), login (5+ fails → lockout + email), logout, session
persistence, security log page, homepage/page-source header check,
a static page's title/canonical in page source, blog post SEO
auto-fill, and pasting a table into the blog editor.