Add Opportunities, Thrive, Blog, and 2026 design system

[jmgasper]

Summary

• adds the Figma-aligned Opportunities listing, challenge details, review details, legacy challenge redirects, lazy server-backed filters, role-correct My competitions, reviewer application roles and public totals, terms, reporting, Markdown H2/H3 TOC, and public-safe Design submission previews
• completes challenge detail parity with format-aware sanitized HTML/Markdown requirements, API-authorized private details, paginated Submitter registrants, environment-aware forums and scorecards, and safe metadata/discussion/attachment links
• displays hydrated Engagement skill names with a backward-compatible requiredSkills fallback
• ports Thrive to the fixed education taxonomy and Blog to the website Payload space using the exact Page and pageContentArticle rich-text contract
• restores safe HTTP(S)-only Thrive external-article navigation and blocks unsafe or retired-host destinations across cards, videos, direct routes, challenge links, and CMS content
• removes the unused Contentful SDK, blocks retired Contentful, CTF Assets, and Octana hosts, and regression-tests unsafe javascript, data, and vbscript rich-text links
• applies the scoped 2026 foundations to Work, Review, Support, System Admin, Calendar, Copilots, Engagements, Procurement, Reports, and Opportunities without changing other applications

Deployment configuration

Required browser-readable Payload tokens:

• REACT_APP_PAYLOAD_CMS_EDU_ACCESS_TOKEN for Thrive education content
• REACT_APP_PAYLOAD_CMS_WEBSITE_ACCESS_TOKEN for website space xooissnm36jt, environment uat, including Blog

REACT_APP_PAYLOAD_CMS_DEFAULT_ACCESS_TOKEN remains supported by the shared CMS library for default-space consumers, but Thrive and Blog do not depend on it. Payload CORS must allow the platform-ui origins. No Contentful or Octana runtime fallback remains.

Deploy the matching API contracts with this UI:

• Challenge API role-aware GET /v6/challenges?memberId=...&resourceRoleId=..., which applies membership before filters, global sorting, counts, and pagination
• Resource API exact challengeId, memberId, and canonical Submitter roleId filters applied before counts and pagination
• Review API public GET /v6/submissions/previews, review opportunity applicationRoles, defaultApplicationRole, and public applicationCount
• Engagement API optional hydrated skills: Array<{ id, name }> while retaining requiredSkills for backward compatibility

Full Figma screen audit

• aligns Competition, Engagement, Copilot, and Review list and grid screens to the authored 1200px desktop geometry, filter rhythm, pagination, fonts, semantic colors, exact SVG controls, content-driven card heights, and responsive fallback
• aligns Challenge detail variants, tabs, prize and winner states, terms dialogs, sidebar, phase lifecycle, registration actions, and Marathon Match 10-placement prize presentation
• aligns Review detail requirements, split and single compensation states, application table, reviewer CTA, support modal, and responsive 792/24/384 layout
• preserves API-backed facets and lifecycle truth instead of fabricating sample Figma data; unsupported fields remain explicit integration boundaries

Validation

• yarn lint passed after final integration
• yarn tsc --noEmit --pretty false passed
• all Opportunities tests passed: 11 suites / 66 tests
• yarn run build passed; existing repository CSS-order, broad lint-warning, and bundle-size warnings remain non-fatal
• desktop 1680px and mobile 393px browser smoke renders passed
• git diff --check passed

Figma card follow-up

• aligns the four opportunity selector cells to the authored dimensions, colors, typography, overlap, map, and exact SVG icon assets
• adds track-specific competition pills, challenge-type icons, registration-state icons, placement-prize footer, phase countdown/progress, and the Figma submissions/registrants/posts rail
• refreshes competition phase timing every minute and on focus, and documents the Challenge API presentation contract