Repair Dev Flow security and project proof

[ahmed-elsayed-programmer]

What changed

• removed unauthenticated public account, user, and OAuth-persistence endpoints
• moved Auth.js persistence behind server-only helpers and excluded password hashes by default
• scoped provider identities and added a unique provider/account index
• upgraded to Next.js 16.3, React 19.2, current Auth.js/Mongoose, and a zero-vulnerability dependency tree
• fixed the production build, tag counters, mixed-case tag edits, regex escaping, unanswered filtering, and author population
• replaced the unsupported editor dependency with a native accessible textarea
• added 8 focused tests, CI, environment documentation, and an evidence-accurate README

Why

The repository was pinned as full-stack proof while its build failed, its README was boilerplate, and generic API routes could expose or mutate account and user records if deployed. This repair makes the public code, documentation, security boundary, and verification commands agree.

Current scope

Dev Flow remains an in-progress portfolio project. Question detail, answers, voting, collections, community, jobs, and profiles are explicitly documented as incomplete. The PR makes no deployment, user, scale, performance, or business-outcome claims.

Verification

• clean npm ci
• npm run lint
• npm run typecheck
• npm test — 8 tests across 2 files
• npm run build on Next.js 16.3
• npm audit — 0 known vulnerabilities
• git diff --check
• independent reviewer: APPROVE