fix(security): Google sign-in and hardened saves, limits and AI data

AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

README.md

@@ -23,7 +23,7 @@
 
 ### Authentication
 
-- Email-only sign-in with auto-registration — no password required
+- Google sign-in with auto-registration — no password required
 - JWT-based sessions with protected routes via middleware
 
 ### Resume Builder
@@ -39,12 +39,12 @@
 
 ### Templates
 
-| Template | Style |
-|----------|-------|
-| **Harvard Style** | Classic academic — left date column with structured content blocks |
-| **Creative / Portfolio** | Brutalist sidebar — black 2.5-inch sidebar with optional avatar photo |
-| **ATS-Optimized** | Two-column clean layout optimized for Applicant Tracking Systems |
-| **Executive / Leadership** | Traditional top-down with professional summary header |
+| Template                   | Style                                                                 |
+| -------------------------- | --------------------------------------------------------------------- |
+| **Harvard Style**          | Classic academic — left date column with structured content blocks    |
+| **Creative / Portfolio**   | Brutalist sidebar — black 2.5-inch sidebar with optional avatar photo |
+| **ATS-Optimized**          | Two-column clean layout optimized for Applicant Tracking Systems      |
+| **Executive / Leadership** | Traditional top-down with professional summary header                 |
 
 ### PDF Export
 
@@ -77,19 +77,19 @@ No smooth gradients. No rounded pills. Pure function.
 
 ## Tech Stack
 
-| Layer | Technology |
-|-------|-----------|
-| Framework | Next.js 16 (App Router, React 19, Turbopack) |
-| Language | TypeScript (strict) |
-| Database | Neon (Serverless Postgres) |
-| ORM | Drizzle ORM |
-| Auth | Auth.js v5 — Credentials provider |
-| Styling | Tailwind CSS 4 |
-| State | Zustand |
-| PDF | @react-pdf/renderer |
-| Image Upload | Cloudinary |
-| i18n | next-intl (EN / VI) |
-| Font | IBM Plex Sans (UI) + 11 Google Fonts (CV) |
+| Layer        | Technology                                   |
+| ------------ | -------------------------------------------- |
+| Framework    | Next.js 16 (App Router, React 19, Turbopack) |
+| Language     | TypeScript (strict)                          |
+| Database     | Neon (Serverless Postgres)                   |
+| ORM          | Drizzle ORM                                  |
+| Auth         | Auth.js v5 — Google sign-in                  |
+| Styling      | Tailwind CSS 4                               |
+| State        | Zustand                                      |
+| PDF          | @react-pdf/renderer                          |
+| Image Upload | Cloudinary                                   |
+| i18n         | next-intl (EN / VI)                          |
+| Font         | IBM Plex Sans (UI) + 11 Google Fonts (CV)    |
 
 ---