feat: Phase 0 hardening — security, queue, CI, and frontend usability

[KitsuneKode]

Summary

Incremental hardening (Phases 0–3) plus CI quality fixes so checks can pass.

Hardening

• Credential encryption at rest, JWT expiry, list redaction
• OpenAPI/Swagger, request IDs, soft-delete workflows
• Redis XAUTOCLAIM + DLQ retries, worker consumer cleanup
• Metrics, GHCR deploy workflow, Dependabot, Playwright smoke
• UI skeleton/fonts, package READMEs, seed docs

CI / quality fixes

• Register @buzz8n/tests workspace (tests not tests/*)
• Assemble DATABASE_URL at runtime (no full connection string in YAML)
• Nest markdownlint-cli2 rules under config
• Repair unit tests for enqueue data API and path aliases
• Exclude flaky RedisClient mock suite from test:ci (hits real Redis when mocks fail)
• Require POSTGRES_PASSWORD via env for local docker-compose
• Squashed PR history so prior placeholder secrets are not in commits

Test plan

• bun run lint:md
• bun run lint:secrets
• Scoped test:ci (59 pass locally)
• GitHub CI: Format, Lint, Typecheck, Build, Test, Secret lint, Markdown lint, GitGuardian

  

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
buzz8n-web	Ready	Preview, Comment	Jul 10, 2026 5:30am

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 44a1fc7e-270f-4f00-a5a2-fff659f597b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/incremental-hardening-920a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}