From ba7308ce13eb300603fa0bc85d07c9035fc72b50 Mon Sep 17 00:00:00 2001
From: Sahil Kumar Singh <sahilkumargreat12@gmail.com>
Date: Mon, 6 Apr 2026 23:03:12 +0530
Subject: [PATCH] feat: harden redis cache ops and clean workspace artifacts

- remove obsolete local agent/spec artifact folders from repository tracking

- add redis hardening settings (username/tls/connect timeout) and env wiring

- instrument cache service hit/miss/write/invalidate/fallback operations

- add CI workflow for compile, JS/shell syntax, and compose validation

- refresh docs for production cache posture and command-center flow
---
 .agent/skills/ai-engineer/SKILL.md            |  171 ---
 .../skills/machine-learning-engineer/SKILL.md |  356 ------
 .agent/skills/senior-backend/SKILL.md         |  434 -------
 .../references/api_design_patterns.md         |  530 --------
 .../references/backend_security_practices.md  | 1075 -----------------
 .../references/database_optimization_guide.md |  593 ---------
 .../senior-backend/scripts/api_load_tester.py |  607 ----------
 .../senior-backend/scripts/api_scaffolder.py  |  645 ----------
 .../scripts/database_migration_tool.py        |  858 -------------
 .agent/skills/spring-boot-engineer/SKILL.md   |  104 --
 .../spring-boot-engineer/references/cloud.md  |  498 --------
 .../spring-boot-engineer/references/data.md   |  381 ------
 .../references/security.md                    |  459 -------
 .../references/testing.md                     |  545 ---------
 .../spring-boot-engineer/references/web.md    |  295 -----
 .claude/skills/ai-engineer/SKILL.md           |  171 ---
 .../skills/machine-learning-engineer/SKILL.md |  356 ------
 .claude/skills/senior-backend/SKILL.md        |  434 -------
 .../references/api_design_patterns.md         |  530 --------
 .../references/backend_security_practices.md  | 1075 -----------------
 .../references/database_optimization_guide.md |  593 ---------
 .../senior-backend/scripts/api_load_tester.py |  607 ----------
 .../senior-backend/scripts/api_scaffolder.py  |  645 ----------
 .../scripts/database_migration_tool.py        |  858 -------------
 .claude/skills/spring-boot-engineer/SKILL.md  |  104 --
 .../spring-boot-engineer/references/cloud.md  |  498 --------
 .../spring-boot-engineer/references/data.md   |  381 ------
 .../references/security.md                    |  459 -------
 .../references/testing.md                     |  545 ---------
 .../spring-boot-engineer/references/web.md    |  295 -----
 .env.example                                  |   13 +
 .github/workflows/ci.yml                      |   50 +
 .gitignore                                    |    5 +
 .../specs/varutri-command-center/.config.kiro |    1 -
 .kiro/specs/varutri-command-center/design.md  |  828 -------------
 .../varutri-command-center/requirements.md    |  246 ----
 CONSUMER_ARCHITECTURE.md                      |   81 +-
 QUICKSTART.md                                 |   25 +
 README.md                                     |   12 +
 compile_output.txt                            |  Bin 1928 -> 0 bytes
 docker-compose.yml                            |   35 +-
 frontend/README.md                            |  143 +--
 frontend/app.js                               | 1041 +++++++++-------
 frontend/index.html                           |  255 ++--
 frontend/style.css                            |  891 ++++++--------
 pom.xml                                       |   12 +
 .../service/core/ConsumerCacheService.java    |  293 ++++-
 src/main/resources/application.properties     |   14 +
 48 files changed, 1612 insertions(+), 17435 deletions(-)
 delete mode 100644 .agent/skills/ai-engineer/SKILL.md
 delete mode 100644 .agent/skills/machine-learning-engineer/SKILL.md
 delete mode 100644 .agent/skills/senior-backend/SKILL.md
 delete mode 100644 .agent/skills/senior-backend/references/api_design_patterns.md
 delete mode 100644 .agent/skills/senior-backend/references/backend_security_practices.md
 delete mode 100644 .agent/skills/senior-backend/references/database_optimization_guide.md
 delete mode 100644 .agent/skills/senior-backend/scripts/api_load_tester.py
 delete mode 100644 .agent/skills/senior-backend/scripts/api_scaffolder.py
 delete mode 100644 .agent/skills/senior-backend/scripts/database_migration_tool.py
 delete mode 100644 .agent/skills/spring-boot-engineer/SKILL.md
 delete mode 100644 .agent/skills/spring-boot-engineer/references/cloud.md
 delete mode 100644 .agent/skills/spring-boot-engineer/references/data.md
 delete mode 100644 .agent/skills/spring-boot-engineer/references/security.md
 delete mode 100644 .agent/skills/spring-boot-engineer/references/testing.md
 delete mode 100644 .agent/skills/spring-boot-engineer/references/web.md
 delete mode 100644 .claude/skills/ai-engineer/SKILL.md
 delete mode 100644 .claude/skills/machine-learning-engineer/SKILL.md
 delete mode 100644 .claude/skills/senior-backend/SKILL.md
 delete mode 100644 .claude/skills/senior-backend/references/api_design_patterns.md
 delete mode 100644 .claude/skills/senior-backend/references/backend_security_practices.md
 delete mode 100644 .claude/skills/senior-backend/references/database_optimization_guide.md
 delete mode 100644 .claude/skills/senior-backend/scripts/api_load_tester.py
 delete mode 100644 .claude/skills/senior-backend/scripts/api_scaffolder.py
 delete mode 100644 .claude/skills/senior-backend/scripts/database_migration_tool.py
 delete mode 100644 .claude/skills/spring-boot-engineer/SKILL.md
 delete mode 100644 .claude/skills/spring-boot-engineer/references/cloud.md
 delete mode 100644 .claude/skills/spring-boot-engineer/references/data.md
 delete mode 100644 .claude/skills/spring-boot-engineer/references/security.md
 delete mode 100644 .claude/skills/spring-boot-engineer/references/testing.md
 delete mode 100644 .claude/skills/spring-boot-engineer/references/web.md
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .kiro/specs/varutri-command-center/.config.kiro
 delete mode 100644 .kiro/specs/varutri-command-center/design.md
 delete mode 100644 .kiro/specs/varutri-command-center/requirements.md
 delete mode 100644 compile_output.txt

diff --git a/.agent/skills/ai-engineer/SKILL.md b/.agent/skills/ai-engineer/SKILL.md
deleted file mode 100644
index e9d2cde..0000000
--- a/.agent/skills/ai-engineer/SKILL.md
+++ /dev/null
@@ -1,171 +0,0 @@
----
-name: ai-engineer
-description: Build production-ready LLM applications, advanced RAG systems, and
-  intelligent agents. Implements vector search, multimodal AI, agent
-  orchestration, and enterprise AI integrations. Use PROACTIVELY for LLM
-  features, chatbots, AI agents, or AI-powered applications.
-metadata:
-  model: inherit
----
-You are an AI engineer specializing in production-grade LLM applications, generative AI systems, and intelligent agent architectures.
-
-## Use this skill when
-
-- Building or improving LLM features, RAG systems, or AI agents
-- Designing production AI architectures and model integration
-- Optimizing vector search, embeddings, or retrieval pipelines
-- Implementing AI safety, monitoring, or cost controls
-
-## Do not use this skill when
-
-- The task is pure data science or traditional ML without LLMs
-- You only need a quick UI change unrelated to AI features
-- There is no access to data sources or deployment targets
-
-## Instructions
-
-1. Clarify use cases, constraints, and success metrics.
-2. Design the AI architecture, data flow, and model selection.
-3. Implement with monitoring, safety, and cost controls.
-4. Validate with tests and staged rollout plans.
-
-## Safety
-
-- Avoid sending sensitive data to external models without approval.
-- Add guardrails for prompt injection, PII, and policy compliance.
-
-## Purpose
-Expert AI engineer specializing in LLM application development, RAG systems, and AI agent architectures. Masters both traditional and cutting-edge generative AI patterns, with deep knowledge of the modern AI stack including vector databases, embedding models, agent frameworks, and multimodal AI systems.
-
-## Capabilities
-
-### LLM Integration & Model Management
-- OpenAI GPT-4o/4o-mini, o1-preview, o1-mini with function calling and structured outputs
-- Anthropic Claude 4.5 Sonnet/Haiku, Claude 4.1 Opus with tool use and computer use
-- Open-source models: Llama 3.1/3.2, Mixtral 8x7B/8x22B, Qwen 2.5, DeepSeek-V2
-- Local deployment with Ollama, vLLM, TGI (Text Generation Inference)
-- Model serving with TorchServe, MLflow, BentoML for production deployment
-- Multi-model orchestration and model routing strategies
-- Cost optimization through model selection and caching strategies
-
-### Advanced RAG Systems
-- Production RAG architectures with multi-stage retrieval pipelines
-- Vector databases: Pinecone, Qdrant, Weaviate, Chroma, Milvus, pgvector
-- Embedding models: OpenAI text-embedding-3-large/small, Cohere embed-v3, BGE-large
-- Chunking strategies: semantic, recursive, sliding window, and document-structure aware
-- Hybrid search combining vector similarity and keyword matching (BM25)
-- Reranking with Cohere rerank-3, BGE reranker, or cross-encoder models
-- Query understanding with query expansion, decomposition, and routing
-- Context compression and relevance filtering for token optimization
-- Advanced RAG patterns: GraphRAG, HyDE, RAG-Fusion, self-RAG
-
-### Agent Frameworks & Orchestration
-- LangChain/LangGraph for complex agent workflows and state management
-- LlamaIndex for data-centric AI applications and advanced retrieval
-- CrewAI for multi-agent collaboration and specialized agent roles
-- AutoGen for conversational multi-agent systems
-- OpenAI Assistants API with function calling and file search
-- Agent memory systems: short-term, long-term, and episodic memory
-- Tool integration: web search, code execution, API calls, database queries
-- Agent evaluation and monitoring with custom metrics
-
-### Vector Search & Embeddings
-- Embedding model selection and fine-tuning for domain-specific tasks
-- Vector indexing strategies: HNSW, IVF, LSH for different scale requirements
-- Similarity metrics: cosine, dot product, Euclidean for various use cases
-- Multi-vector representations for complex document structures
-- Embedding drift detection and model versioning
-- Vector database optimization: indexing, sharding, and caching strategies
-
-### Prompt Engineering & Optimization
-- Advanced prompting techniques: chain-of-thought, tree-of-thoughts, self-consistency
-- Few-shot and in-context learning optimization
-- Prompt templates with dynamic variable injection and conditioning
-- Constitutional AI and self-critique patterns
-- Prompt versioning, A/B testing, and performance tracking
-- Safety prompting: jailbreak detection, content filtering, bias mitigation
-- Multi-modal prompting for vision and audio models
-
-### Production AI Systems
-- LLM serving with FastAPI, async processing, and load balancing
-- Streaming responses and real-time inference optimization
-- Caching strategies: semantic caching, response memoization, embedding caching
-- Rate limiting, quota management, and cost controls
-- Error handling, fallback strategies, and circuit breakers
-- A/B testing frameworks for model comparison and gradual rollouts
-- Observability: logging, metrics, tracing with LangSmith, Phoenix, Weights & Biases
-
-### Multimodal AI Integration
-- Vision models: GPT-4V, Claude 4 Vision, LLaVA, CLIP for image understanding
-- Audio processing: Whisper for speech-to-text, ElevenLabs for text-to-speech
-- Document AI: OCR, table extraction, layout understanding with models like LayoutLM
-- Video analysis and processing for multimedia applications
-- Cross-modal embeddings and unified vector spaces
-
-### AI Safety & Governance
-- Content moderation with OpenAI Moderation API and custom classifiers
-- Prompt injection detection and prevention strategies
-- PII detection and redaction in AI workflows
-- Model bias detection and mitigation techniques
-- AI system auditing and compliance reporting
-- Responsible AI practices and ethical considerations
-
-### Data Processing & Pipeline Management
-- Document processing: PDF extraction, web scraping, API integrations
-- Data preprocessing: cleaning, normalization, deduplication
-- Pipeline orchestration with Apache Airflow, Dagster, Prefect
-- Real-time data ingestion with Apache Kafka, Pulsar
-- Data versioning with DVC, lakeFS for reproducible AI pipelines
-- ETL/ELT processes for AI data preparation
-
-### Integration & API Development
-- RESTful API design for AI services with FastAPI, Flask
-- GraphQL APIs for flexible AI data querying
-- Webhook integration and event-driven architectures
-- Third-party AI service integration: Azure OpenAI, AWS Bedrock, GCP Vertex AI
-- Enterprise system integration: Slack bots, Microsoft Teams apps, Salesforce
-- API security: OAuth, JWT, API key management
-
-## Behavioral Traits
-- Prioritizes production reliability and scalability over proof-of-concept implementations
-- Implements comprehensive error handling and graceful degradation
-- Focuses on cost optimization and efficient resource utilization
-- Emphasizes observability and monitoring from day one
-- Considers AI safety and responsible AI practices in all implementations
-- Uses structured outputs and type safety wherever possible
-- Implements thorough testing including adversarial inputs
-- Documents AI system behavior and decision-making processes
-- Stays current with rapidly evolving AI/ML landscape
-- Balances cutting-edge techniques with proven, stable solutions
-
-## Knowledge Base
-- Latest LLM developments and model capabilities (GPT-4o, Claude 4.5, Llama 3.2)
-- Modern vector database architectures and optimization techniques
-- Production AI system design patterns and best practices
-- AI safety and security considerations for enterprise deployments
-- Cost optimization strategies for LLM applications
-- Multimodal AI integration and cross-modal learning
-- Agent frameworks and multi-agent system architectures
-- Real-time AI processing and streaming inference
-- AI observability and monitoring best practices
-- Prompt engineering and optimization methodologies
-
-## Response Approach
-1. **Analyze AI requirements** for production scalability and reliability
-2. **Design system architecture** with appropriate AI components and data flow
-3. **Implement production-ready code** with comprehensive error handling
-4. **Include monitoring and evaluation** metrics for AI system performance
-5. **Consider cost and latency** implications of AI service usage
-6. **Document AI behavior** and provide debugging capabilities
-7. **Implement safety measures** for responsible AI deployment
-8. **Provide testing strategies** including adversarial and edge cases
-
-## Example Interactions
-- "Build a production RAG system for enterprise knowledge base with hybrid search"
-- "Implement a multi-agent customer service system with escalation workflows"
-- "Design a cost-optimized LLM inference pipeline with caching and load balancing"
-- "Create a multimodal AI system for document analysis and question answering"
-- "Build an AI agent that can browse the web and perform research tasks"
-- "Implement semantic search with reranking for improved retrieval accuracy"
-- "Design an A/B testing framework for comparing different LLM prompts"
-- "Create a real-time AI content moderation system with custom classifiers"
diff --git a/.agent/skills/machine-learning-engineer/SKILL.md b/.agent/skills/machine-learning-engineer/SKILL.md
deleted file mode 100644
index e1e80c7..0000000
--- a/.agent/skills/machine-learning-engineer/SKILL.md
+++ /dev/null
@@ -1,356 +0,0 @@
----
-name: machine-learning-engineer
-description: Use when user needs ML model deployment, production serving infrastructure, optimization strategies, and real-time inference systems. Designs and implements scalable ML systems with focus on reliability and performance.
----
-
-# Machine Learning Engineer
-
-## Purpose
-
-Provides ML engineering expertise specializing in model deployment, production serving infrastructure, and real-time inference systems. Designs scalable ML platforms with model optimization, auto-scaling, and monitoring for reliable production machine learning workloads.
-
-## When to Use
-
-- ML model deployment to production
-- Real-time inference API development
-- Model optimization and compression
-- Batch prediction systems
-- Auto-scaling and load balancing
-- Edge deployment for IoT/mobile
-- Multi-model serving orchestration
-- Performance tuning and latency optimization
-
-This skill provides expert ML engineering capabilities for deploying and serving machine learning models at scale. It focuses on model optimization, inference infrastructure, real-time serving, and edge deployment with emphasis on building reliable, performant ML systems for production workloads.
-
-## When to Use
-
-User needs:
-- ML model deployment to production
-- Real-time inference API development
-- Model optimization and compression
-- Batch prediction systems
-- Auto-scaling and load balancing
-- Edge deployment for IoT/mobile
-- Multi-model serving orchestration
-- Performance tuning and latency optimization
-
-## What This Skill Does
-
-This skill deploys ML models to production with comprehensive infrastructure. It optimizes models for inference, builds serving pipelines, configures auto-scaling, implements monitoring, and ensures models meet performance, reliability, and scalability requirements in production environments.
-
-### ML Deployment Components
-
-- Model optimization and compression
-- Serving infrastructure (REST/gRPC APIs, batch jobs)
-- Load balancing and request routing
-- Auto-scaling and resource management
-- Real-time and batch prediction systems
-- Monitoring, logging, and observability
-- Edge deployment and model compression
-- A/B testing and canary deployments
-
-## Core Capabilities
-
-### Model Deployment Pipelines
-- CI/CD integration for ML models
-- Automated testing and validation
-- Model performance benchmarking
-- Security scanning and vulnerability assessment
-- Container building and registry management
-- Progressive rollout and blue-green deployment
-
-### Serving Infrastructure
-- Load balancer configuration (NGINX, HAProxy)
-- Request routing and model caching
-- Connection pooling and health checking
-- Graceful shutdown and resource allocation
-- Multi-region deployment and failover
-- Container orchestration (Kubernetes, ECS)
-
-### Model Optimization
-- Quantization (FP32, FP16, INT8, INT4)
-- Model pruning and sparsification
-- Knowledge distillation techniques
-- ONNX and TensorRT conversion
-- Graph optimization and operator fusion
-- Memory optimization and throughput tuning
-
-### Real-time Inference
-- Request preprocessing and validation
-- Model prediction execution
-- Response formatting and error handling
-- Timeout management and circuit breaking
-- Request batching and response caching
-- Streaming predictions and async processing
-
-### Batch Prediction Systems
-- Job scheduling and orchestration
-- Data partitioning and parallel processing
-- Progress tracking and error handling
-- Result aggregation and storage
-- Cost optimization and resource management
-
-### Auto-scaling Strategies
-- Metric-based scaling (CPU, GPU, request rate)
-- Scale-up and scale-down policies
-- Warm-up periods and predictive scaling
-- Cost controls and regional distribution
-- Traffic prediction and capacity planning
-
-### Multi-model Serving
-- Model routing and version management
-- A/B testing and traffic splitting
-- Ensemble serving and model cascading
-- Fallback strategies and performance isolation
-- Shadow mode testing and validation
-
-### Edge Deployment
-- Model compression for edge devices
-- Hardware optimization and power efficiency
-- Offline capability and update mechanisms
-- Telemetry collection and security hardening
-- Resource constraints and optimization
-
-## Tool Restrictions
-
-- Read: Access model artifacts, infrastructure configs, and monitoring data
-- Write/Edit: Create deployment configs, serving code, and optimization scripts
-- Bash: Execute deployment commands, monitoring setup, and performance tests
-- Glob/Grep: Search codebases for model integration and serving endpoints
-
-## Integration with Other Skills
-
-- ml-engineer: Model optimization and training pipeline integration
-- mlops-engineer: Infrastructure and platform setup
-- data-engineer: Data pipelines and feature stores
-- devops-engineer: CI/CD and deployment automation
-- cloud-architect: Cloud infrastructure and architecture
-- sre-engineer: Reliability and availability
-- performance-engineer: Performance profiling and optimization
-- ai-engineer: Model selection and integration
-
-## Example Interactions
-
-### Scenario 1: Real-time Inference API Deployment
-
-**User:** "Deploy our ML model as a real-time API with auto-scaling"
-
-**Interaction:**
-1. Skill analyzes model characteristics and requirements
-2. Implements serving infrastructure:
-   - Optimizes model with ONNX conversion (60% size reduction)
-   - Creates FastAPI/gRPC serving endpoints
-   - Configures GPU auto-scaling based on request rate
-   - Implements request batching for throughput
-   - Sets up monitoring and alerting
-3. Deploys to Kubernetes with horizontal pod autoscaler
-4. Achieves <50ms P99 latency and 2000+ RPS throughput
-
-### Scenario 2: Multi-model Serving Platform
-
-**User:** "Build a platform to serve 50+ models with intelligent routing"
-
-**Interaction:**
-1. Skill designs multi-model architecture:
-   - Model registry and version management
-   - Intelligent routing based on request type
-   - Specialist models for different use cases
-   - Fallback and circuit breaking
-   - Cost optimization with smaller models for simple queries
-2. Implements serving framework with:
-   - Model loading and unloading
-   - Request queuing and load balancing
-   - A/B testing and traffic splitting
-   - Ensemble serving for critical paths
-3. Deploys with comprehensive monitoring and cost tracking
-
-### Scenario 3: Edge Deployment for IoT
-
-**User:** "Deploy ML model to edge devices with limited resources"
-
-**Interaction:**
-1. Skill analyzes device constraints and requirements
-2. Optimizes model for edge:
-   - Quantizes to INT8 (4x size reduction)
-   - Prunes and compresses model
-   - Implements ONNX Runtime for efficient inference
-   - Adds offline capability and local caching
-3. Creates deployment package:
-   - Edge-optimized inference runtime
-   - Update mechanism with delta updates
-   - Telemetry collection and monitoring
-   - Security hardening and encryption
-4. Tests on target hardware and validates performance
-
-## Best Practices
-
-- Performance: Target <100ms P99 latency for real-time inference
-- Reliability: Implement graceful degradation and fallback models
-- Monitoring: Track latency, throughput, error rates, and resource usage
-- Testing: Conduct load testing and validate against production traffic patterns
-- Security: Implement authentication, encryption, and model security
-- Documentation: Document all deployment configurations and operational procedures
-- Cost: Optimize resource usage and implement auto-scaling for cost efficiency
-
-## Examples
-
-### Example 1: Real-Time Inference API for Production
-
-**Scenario:** Deploy a fraud detection model as a real-time API with auto-scaling.
-
-**Deployment Approach:**
-1. **Model Optimization**: Converted model to ONNX (60% size reduction)
-2. **Serving Framework**: Built FastAPI endpoints with async processing
-3. **Infrastructure**: Kubernetes deployment with Horizontal Pod Autoscaler
-4. **Monitoring**: Integrated Prometheus metrics and Grafana dashboards
-
-**Configuration:**
-```python
-# FastAPI serving with optimization
-from fastapi import FastAPI
-import onnxruntime as ort
-
-app = FastAPI()
-session = ort.InferenceSession("model.onnx")
-
-@app.post("/predict")
-async def predict(features: List[float]):
-    input_tensor = np.array([features])
-    outputs = session.run(None, {"input": input_tensor})
-    return {"prediction": outputs[0].tolist()}
-```
-
-**Performance Results:**
-| Metric | Value |
-|--------|-------|
-| P99 Latency | 45ms |
-| Throughput | 2,500 RPS |
-| Availability | 99.99% |
-| Auto-scaling | 2-50 pods |
-
-### Example 2: Multi-Model Serving Platform
-
-**Scenario:** Build a platform serving 50+ ML models for different prediction types.
-
-**Architecture Design:**
-1. **Model Registry**: Central registry with versioning
-2. **Router**: Intelligent routing based on request type
-3. **Resource Manager**: Dynamic resource allocation per model
-4. **Fallback System**: Graceful degradation for unavailable models
-
-**Implementation:**
-- Model loading/unloading based on request patterns
-- A/B testing framework for model comparisons
-- Cost optimization with model prioritization
-- Shadow mode testing for new models
-
-**Results:**
-- 50+ models deployed with 99.9% uptime
-- 40% reduction in infrastructure costs
-- Zero downtime during model updates
-- 95% cache hit rate for frequent requests
-
-### Example 3: Edge Deployment for Mobile Devices
-
-**Scenario:** Deploy image classification model to iOS and Android apps.
-
-**Edge Optimization:**
-1. **Model Compression**: Quantized to INT8 (4x size reduction)
-2. **Runtime Selection**: CoreML for iOS, TFLite for Android
-3. **On-Device Caching**: Intelligent model caching and updates
-4. **Privacy Compliance**: All processing on-device
-
-**Performance Metrics:**
-| Platform | Model Size | Inference Time | Accuracy |
-|----------|------------|----------------|----------|
-| Original | 25 MB | 150ms | 94.2% |
-| Optimized | 6 MB | 35ms | 93.8% |
-
-**Results:**
-- 80% reduction in app download size
-- 4x faster inference on device
-- Offline capability with local inference
-- GDPR compliant (no data leaves device)
-
-## Best Practices
-
-### Model Optimization
-
-- **Quantization**: Start with FP16, move to INT8 for edge
-- **Pruning**: Remove unnecessary weights for efficiency
-- **Distillation**: Transfer knowledge to smaller models
-- **ONNX Export**: Standard format for cross-platform deployment
-- **Benchmarking**: Always test on target hardware
-
-### Production Serving
-
-- **Health Checks**: Implement /health and /ready endpoints
-- **Graceful Degradation**: Fallback to simpler models or heuristics
-- **Circuit Breakers**: Prevent cascade failures
-- **Rate Limiting**: Protect against abuse and overuse
-- **Caching**: Cache predictions for identical inputs
-
-### Monitoring and Observability
-
-- **Latency Tracking**: Monitor P50, P95, P99 latencies
-- **Error Rates**: Track failures and error types
-- **Prediction Distribution**: Alert on distribution shifts
-- **Resource Usage**: CPU, GPU, memory monitoring
-- **Business Metrics**: Track model impact on KPIs
-
-### Security and Compliance
-
-- **Model Security**: Protect model weights and artifacts
-- **Input Validation**: Sanitize all prediction inputs
-- **Output Filtering**: Prevent sensitive data exposure
-- **Audit Logging**: Log all prediction requests
-- **Compliance**: Meet industry regulations (HIPAA, GDPR)
-
-## Anti-Patterns
-
-### Model Deployment Anti-Patterns
-
-- **Manual Deployment**: Deploying models without automation - implement CI/CD for models
-- **No Versioning**: Replacing models without tracking versions - maintain model version history
-- **Hotfix Culture**: Making urgent model changes without testing - require validation before deployment
-- **Black Box Deployment**: Deploying models without explainability - implement model interpretability
-
-### Performance Anti-Patterns
-
-- **No Baselines**: Deploying without performance benchmarks - establish performance baselines
-- **Over-Optimization**: Tuning beyond practical benefit - focus on customer-impacting metrics
-- **Ignore Latency**: Focusing only on accuracy, ignoring latency - optimize for real-world use cases
-- **Resource Waste**: Over-provisioning infrastructure - right-size resources based on actual load
-
-### Monitoring Anti-Patterns
-
-- **Silent Failures**: Models failing without detection - implement comprehensive health checks
-- **Metric Overload**: Monitoring too many metrics - focus on actionable metrics
-- **Data Drift Blindness**: Not detecting model degradation - monitor input data distribution
-- **Alert Fatigue**: Too many alerts causing ignored warnings - tune alert thresholds
-
-### Scalability Anti-Patterns
-
-- **No Load Testing**: Deploying without performance testing - test with production-like traffic
-- **Single Point of Failure**: No redundancy in serving infrastructure - implement failover
-- **No Autoscaling**: Manual capacity management - implement automatic scaling
-- **Stateful Design**: Inference that requires state - design stateless inference
-
-## Output Format
-
-This skill delivers:
-- Complete model serving infrastructure (Docker, Kubernetes configs)
-- Production deployment pipelines and CI/CD workflows
-- Real-time and batch prediction APIs
-- Model optimization artifacts and configurations
-- Auto-scaling policies and infrastructure as code
-- Monitoring dashboards and alert configurations
-- Performance benchmarks and load test reports
-
-All outputs include:
-- Detailed architecture documentation
-- Deployment scripts and configurations
-- Performance metrics and SLA validations
-- Security hardening guidelines
-- Operational runbooks and troubleshooting guides
-- Cost analysis and optimization recommendations
diff --git a/.agent/skills/senior-backend/SKILL.md b/.agent/skills/senior-backend/SKILL.md
deleted file mode 100644
index 0ae08a6..0000000
--- a/.agent/skills/senior-backend/SKILL.md
+++ /dev/null
@@ -1,434 +0,0 @@
----
-name: senior-backend
-description: This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Use for Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns.
----
-
-# Senior Backend Engineer
-
-Backend development patterns, API design, database optimization, and security practices.
-
-## Table of Contents
-
-- [Quick Start](#quick-start)
-- [Tools Overview](#tools-overview)
-  - [API Scaffolder](#1-api-scaffolder)
-  - [Database Migration Tool](#2-database-migration-tool)
-  - [API Load Tester](#3-api-load-tester)
-- [Backend Development Workflows](#backend-development-workflows)
-  - [API Design Workflow](#api-design-workflow)
-  - [Database Optimization Workflow](#database-optimization-workflow)
-  - [Security Hardening Workflow](#security-hardening-workflow)
-- [Reference Documentation](#reference-documentation)
-- [Common Patterns Quick Reference](#common-patterns-quick-reference)
-
----
-
-## Quick Start
-
-```bash
-# Generate API routes from OpenAPI spec
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-
-# Analyze database schema and generate migrations
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb --analyze
-
-# Load test an API endpoint
-python scripts/api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-```
-
----
-
-## Tools Overview
-
-### 1. API Scaffolder
-
-Generates API route handlers, middleware, and OpenAPI specifications from schema definitions.
-
-**Input:** OpenAPI spec (YAML/JSON) or database schema
-**Output:** Route handlers, validation middleware, TypeScript types
-
-**Usage:**
-```bash
-# Generate Express routes from OpenAPI spec
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-
-# Output:
-# Generated 12 route handlers in src/routes/
-# - GET /users (listUsers)
-# - POST /users (createUser)
-# - GET /users/{id} (getUser)
-# - PUT /users/{id} (updateUser)
-# - DELETE /users/{id} (deleteUser)
-# ...
-# Created validation middleware: src/middleware/validators.ts
-# Created TypeScript types: src/types/api.ts
-
-# Generate from database schema
-python scripts/api_scaffolder.py --from-db postgres://localhost/mydb --output src/routes/
-
-# Generate OpenAPI spec from existing routes
-python scripts/api_scaffolder.py src/routes/ --generate-spec --output openapi.yaml
-```
-
-**Supported Frameworks:**
-- Express.js (`--framework express`)
-- Fastify (`--framework fastify`)
-- Koa (`--framework koa`)
-
----
-
-### 2. Database Migration Tool
-
-Analyzes database schemas, detects changes, and generates migration files with rollback support.
-
-**Input:** Database connection string or schema files
-**Output:** Migration files, schema diff report, optimization suggestions
-
-**Usage:**
-```bash
-# Analyze current schema and suggest optimizations
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb --analyze
-
-# Output:
-# === Database Analysis Report ===
-# Tables: 24
-# Total rows: 1,247,832
-#
-# MISSING INDEXES (5 found):
-#   orders.user_id - 847ms avg query time, ADD INDEX recommended
-#   products.category_id - 234ms avg query time, ADD INDEX recommended
-#
-# N+1 QUERY RISKS (3 found):
-#   users -> orders relationship (no eager loading)
-#
-# SUGGESTED MIGRATIONS:
-#   1. Add index on orders(user_id)
-#   2. Add index on products(category_id)
-#   3. Add composite index on order_items(order_id, product_id)
-
-# Generate migration from schema diff
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb \
-  --compare schema/v2.sql --output migrations/
-
-# Output:
-# Generated migration: migrations/20240115_add_user_indexes.sql
-# Generated rollback: migrations/20240115_add_user_indexes_rollback.sql
-
-# Dry-run a migration
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb \
-  --migrate migrations/20240115_add_user_indexes.sql --dry-run
-```
-
----
-
-### 3. API Load Tester
-
-Performs HTTP load testing with configurable concurrency, measuring latency percentiles and throughput.
-
-**Input:** API endpoint URL and test configuration
-**Output:** Performance report with latency distribution, error rates, throughput metrics
-
-**Usage:**
-```bash
-# Basic load test
-python scripts/api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-
-# Output:
-# === Load Test Results ===
-# Target: https://api.example.com/users
-# Duration: 30s | Concurrency: 50
-#
-# THROUGHPUT:
-#   Total requests: 15,247
-#   Requests/sec: 508.2
-#   Successful: 15,102 (99.0%)
-#   Failed: 145 (1.0%)
-#
-# LATENCY (ms):
-#   Min: 12
-#   Avg: 89
-#   P50: 67
-#   P95: 198
-#   P99: 423
-#   Max: 1,247
-#
-# ERRORS:
-#   Connection timeout: 89
-#   HTTP 503: 56
-#
-# RECOMMENDATION: P99 latency (423ms) exceeds 200ms target.
-# Consider: connection pooling, query optimization, or horizontal scaling.
-
-# Test with custom headers and body
-python scripts/api_load_tester.py https://api.example.com/orders \
-  --method POST \
-  --header "Authorization: Bearer token123" \
-  --body '{"product_id": 1, "quantity": 2}' \
-  --concurrency 100 \
-  --duration 60
-
-# Compare two endpoints
-python scripts/api_load_tester.py https://api.example.com/v1/users https://api.example.com/v2/users \
-  --compare --concurrency 50 --duration 30
-```
-
----
-
-## Backend Development Workflows
-
-### API Design Workflow
-
-Use when designing a new API or refactoring existing endpoints.
-
-**Step 1: Define resources and operations**
-```yaml
-# openapi.yaml
-openapi: 3.0.3
-info:
-  title: User Service API
-  version: 1.0.0
-paths:
-  /users:
-    get:
-      summary: List users
-      parameters:
-        - name: limit
-          in: query
-          schema:
-            type: integer
-            default: 20
-    post:
-      summary: Create user
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateUser'
-```
-
-**Step 2: Generate route scaffolding**
-```bash
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-```
-
-**Step 3: Implement business logic**
-```typescript
-// src/routes/users.ts (generated, then customized)
-export const createUser = async (req: Request, res: Response) => {
-  const { email, name } = req.body;
-
-  // Add business logic
-  const user = await userService.create({ email, name });
-
-  res.status(201).json(user);
-};
-```
-
-**Step 4: Add validation middleware**
-```bash
-# Validation is auto-generated from OpenAPI schema
-# src/middleware/validators.ts includes:
-# - Request body validation
-# - Query parameter validation
-# - Path parameter validation
-```
-
-**Step 5: Generate updated OpenAPI spec**
-```bash
-python scripts/api_scaffolder.py src/routes/ --generate-spec --output openapi.yaml
-```
-
----
-
-### Database Optimization Workflow
-
-Use when queries are slow or database performance needs improvement.
-
-**Step 1: Analyze current performance**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-```
-
-**Step 2: Identify slow queries**
-```sql
--- Check query execution plans
-EXPLAIN ANALYZE SELECT * FROM orders
-WHERE user_id = 123
-ORDER BY created_at DESC
-LIMIT 10;
-
--- Look for: Seq Scan (bad), Index Scan (good)
-```
-
-**Step 3: Generate index migrations**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --suggest-indexes --output migrations/
-```
-
-**Step 4: Test migration (dry-run)**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --migrate migrations/add_indexes.sql --dry-run
-```
-
-**Step 5: Apply and verify**
-```bash
-# Apply migration
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --migrate migrations/add_indexes.sql
-
-# Verify improvement
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-```
-
----
-
-### Security Hardening Workflow
-
-Use when preparing an API for production or after a security review.
-
-**Step 1: Review authentication setup**
-```typescript
-// Verify JWT configuration
-const jwtConfig = {
-  secret: process.env.JWT_SECRET,  // Must be from env, never hardcoded
-  expiresIn: '1h',                 // Short-lived tokens
-  algorithm: 'RS256'               // Prefer asymmetric
-};
-```
-
-**Step 2: Add rate limiting**
-```typescript
-import rateLimit from 'express-rate-limit';
-
-const apiLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,  // 15 minutes
-  max: 100,                   // 100 requests per window
-  standardHeaders: true,
-  legacyHeaders: false,
-});
-
-app.use('/api/', apiLimiter);
-```
-
-**Step 3: Validate all inputs**
-```typescript
-import { z } from 'zod';
-
-const CreateUserSchema = z.object({
-  email: z.string().email().max(255),
-  name: z.string().min(1).max(100),
-  age: z.number().int().positive().optional()
-});
-
-// Use in route handler
-const data = CreateUserSchema.parse(req.body);
-```
-
-**Step 4: Load test with attack patterns**
-```bash
-# Test rate limiting
-python scripts/api_load_tester.py https://api.example.com/login \
-  --concurrency 200 --duration 10 --expect-rate-limit
-
-# Test input validation
-python scripts/api_load_tester.py https://api.example.com/users \
-  --method POST \
-  --body '{"email": "not-an-email"}' \
-  --expect-status 400
-```
-
-**Step 5: Review security headers**
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet({
-  contentSecurityPolicy: true,
-  crossOriginEmbedderPolicy: true,
-  crossOriginOpenerPolicy: true,
-  crossOriginResourcePolicy: true,
-  hsts: { maxAge: 31536000, includeSubDomains: true },
-}));
-```
-
----
-
-## Reference Documentation
-
-| File | Contains | Use When |
-|------|----------|----------|
-| `references/api_design_patterns.md` | REST vs GraphQL, versioning, error handling, pagination | Designing new APIs |
-| `references/database_optimization_guide.md` | Indexing strategies, query optimization, N+1 solutions | Fixing slow queries |
-| `references/backend_security_practices.md` | OWASP Top 10, auth patterns, input validation | Security hardening |
-
----
-
-## Common Patterns Quick Reference
-
-### REST API Response Format
-```json
-{
-  "data": { "id": 1, "name": "John" },
-  "meta": { "requestId": "abc-123" }
-}
-```
-
-### Error Response Format
-```json
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid email format",
-    "details": [{ "field": "email", "message": "must be valid email" }]
-  },
-  "meta": { "requestId": "abc-123" }
-}
-```
-
-### HTTP Status Codes
-| Code | Use Case |
-|------|----------|
-| 200 | Success (GET, PUT, PATCH) |
-| 201 | Created (POST) |
-| 204 | No Content (DELETE) |
-| 400 | Validation error |
-| 401 | Authentication required |
-| 403 | Permission denied |
-| 404 | Resource not found |
-| 429 | Rate limit exceeded |
-| 500 | Internal server error |
-
-### Database Index Strategy
-```sql
--- Single column (equality lookups)
-CREATE INDEX idx_users_email ON users(email);
-
--- Composite (multi-column queries)
-CREATE INDEX idx_orders_user_status ON orders(user_id, status);
-
--- Partial (filtered queries)
-CREATE INDEX idx_orders_active ON orders(created_at) WHERE status = 'active';
-
--- Covering (avoid table lookup)
-CREATE INDEX idx_users_email_name ON users(email) INCLUDE (name);
-```
-
----
-
-## Common Commands
-
-```bash
-# API Development
-python scripts/api_scaffolder.py openapi.yaml --framework express
-python scripts/api_scaffolder.py src/routes/ --generate-spec
-
-# Database Operations
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-python scripts/database_migration_tool.py --connection $DATABASE_URL --migrate file.sql
-
-# Performance Testing
-python scripts/api_load_tester.py https://api.example.com/endpoint --concurrency 50
-python scripts/api_load_tester.py https://api.example.com/endpoint --compare baseline.json
-```
diff --git a/.agent/skills/senior-backend/references/api_design_patterns.md b/.agent/skills/senior-backend/references/api_design_patterns.md
deleted file mode 100644
index e45a976..0000000
--- a/.agent/skills/senior-backend/references/api_design_patterns.md
+++ /dev/null
@@ -1,530 +0,0 @@
-# API Design Patterns
-
-Concrete patterns for REST and GraphQL API design with examples.
-
-## Patterns Index
-
-1. [REST vs GraphQL Decision](#1-rest-vs-graphql-decision)
-2. [Resource Naming Conventions](#2-resource-naming-conventions)
-3. [API Versioning Strategies](#3-api-versioning-strategies)
-4. [Error Handling Patterns](#4-error-handling-patterns)
-5. [Pagination Patterns](#5-pagination-patterns)
-6. [Authentication Patterns](#6-authentication-patterns)
-7. [Rate Limiting Design](#7-rate-limiting-design)
-8. [Idempotency Patterns](#8-idempotency-patterns)
-
----
-
-## 1. REST vs GraphQL Decision
-
-### When to Use REST
-
-| Scenario | Why REST |
-|----------|----------|
-| Simple CRUD operations | Less complexity, widely understood |
-| Public APIs | Better caching, easier documentation |
-| File uploads/downloads | Native HTTP support |
-| Microservices communication | Simpler service-to-service calls |
-| Caching is critical | HTTP caching built-in |
-
-### When to Use GraphQL
-
-| Scenario | Why GraphQL |
-|----------|-------------|
-| Mobile apps with bandwidth constraints | Request only needed fields |
-| Complex nested data | Single request for related data |
-| Rapidly changing frontend requirements | Frontend-driven queries |
-| Multiple client types | Each client queries what it needs |
-| Real-time subscriptions needed | Built-in subscription support |
-
-### Hybrid Approach
-
-```
-┌─────────────────────────────────────────────────────┐
-│                    API Gateway                       │
-├─────────────────────────────────────────────────────┤
-│  /api/v1/*  →  REST (Public API, webhooks)          │
-│  /graphql   →  GraphQL (Mobile apps, dashboards)    │
-│  /files/*   →  REST (File uploads/downloads)        │
-└─────────────────────────────────────────────────────┘
-```
-
----
-
-## 2. Resource Naming Conventions
-
-### REST Endpoint Patterns
-
-```
-# Collections (plural nouns)
-GET    /users              # List users
-POST   /users              # Create user
-GET    /users/{id}         # Get user
-PUT    /users/{id}         # Replace user
-PATCH  /users/{id}         # Update user
-DELETE /users/{id}         # Delete user
-
-# Nested resources
-GET    /users/{id}/orders          # User's orders
-POST   /users/{id}/orders          # Create order for user
-GET    /users/{id}/orders/{orderId} # Specific order
-
-# Actions (when CRUD doesn't fit)
-POST   /users/{id}/activate        # Activate user
-POST   /orders/{id}/cancel         # Cancel order
-POST   /payments/{id}/refund       # Refund payment
-
-# Filtering, sorting, pagination
-GET    /users?status=active&sort=-created_at&limit=20&offset=40
-GET    /orders?user_id=123&status=pending
-```
-
-### Naming Rules
-
-| Rule | Good | Bad |
-|------|------|-----|
-| Use plural nouns | `/users` | `/user` |
-| Use lowercase | `/user-profiles` | `/userProfiles` |
-| Use hyphens | `/order-items` | `/order_items` |
-| No verbs in URLs | `POST /orders` | `POST /createOrder` |
-| No file extensions | `/users/123` | `/users/123.json` |
-
----
-
-## 3. API Versioning Strategies
-
-### Strategy Comparison
-
-| Strategy | Example | Pros | Cons |
-|----------|---------|------|------|
-| URL Path | `/api/v1/users` | Explicit, easy routing | URL changes |
-| Header | `Accept: application/vnd.api+json;version=1` | Clean URLs | Hidden version |
-| Query Param | `/users?version=1` | Easy to test | Pollutes query string |
-
-### Recommended: URL Path Versioning
-
-```typescript
-// Express routing
-import v1Routes from './routes/v1';
-import v2Routes from './routes/v2';
-
-app.use('/api/v1', v1Routes);
-app.use('/api/v2', v2Routes);
-```
-
-### Deprecation Strategy
-
-```typescript
-// Add deprecation headers
-app.use('/api/v1', (req, res, next) => {
-  res.set('Deprecation', 'true');
-  res.set('Sunset', 'Sat, 01 Jun 2025 00:00:00 GMT');
-  res.set('Link', '</api/v2>; rel="successor-version"');
-  next();
-}, v1Routes);
-```
-
-### Breaking vs Non-Breaking Changes
-
-**Non-breaking (safe):**
-- Adding new endpoints
-- Adding optional fields
-- Adding new enum values at end
-
-**Breaking (requires new version):**
-- Removing endpoints or fields
-- Renaming fields
-- Changing field types
-- Changing required/optional status
-
----
-
-## 4. Error Handling Patterns
-
-### Standard Error Response Format
-
-```json
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Request validation failed",
-    "details": [
-      {
-        "field": "email",
-        "code": "INVALID_FORMAT",
-        "message": "Must be a valid email address"
-      },
-      {
-        "field": "age",
-        "code": "OUT_OF_RANGE",
-        "message": "Must be between 18 and 120"
-      }
-    ],
-    "documentation_url": "https://api.example.com/docs/errors#validation"
-  },
-  "meta": {
-    "request_id": "req_abc123",
-    "timestamp": "2024-01-15T10:30:00Z"
-  }
-}
-```
-
-### Error Codes by Category
-
-```typescript
-// Client errors (4xx)
-const ClientErrors = {
-  VALIDATION_ERROR: 400,
-  INVALID_JSON: 400,
-  AUTHENTICATION_REQUIRED: 401,
-  INVALID_TOKEN: 401,
-  TOKEN_EXPIRED: 401,
-  PERMISSION_DENIED: 403,
-  RESOURCE_NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  RATE_LIMIT_EXCEEDED: 429,
-};
-
-// Server errors (5xx)
-const ServerErrors = {
-  INTERNAL_ERROR: 500,
-  DATABASE_ERROR: 500,
-  EXTERNAL_SERVICE_ERROR: 502,
-  SERVICE_UNAVAILABLE: 503,
-};
-```
-
-### Error Handler Implementation
-
-```typescript
-// Express error handler
-interface ApiError extends Error {
-  code: string;
-  statusCode: number;
-  details?: Array<{ field: string; message: string }>;
-}
-
-const errorHandler: ErrorRequestHandler = (err: ApiError, req, res, next) => {
-  const statusCode = err.statusCode || 500;
-  const code = err.code || 'INTERNAL_ERROR';
-
-  // Log server errors
-  if (statusCode >= 500) {
-    logger.error({ err, requestId: req.id }, 'Server error');
-  }
-
-  res.status(statusCode).json({
-    error: {
-      code,
-      message: statusCode >= 500 ? 'An unexpected error occurred' : err.message,
-      details: err.details,
-      ...(process.env.NODE_ENV === 'development' && { stack: err.stack }),
-    },
-    meta: {
-      request_id: req.id,
-      timestamp: new Date().toISOString(),
-    },
-  });
-};
-```
-
----
-
-## 5. Pagination Patterns
-
-### Offset-Based Pagination
-
-```
-GET /users?limit=20&offset=40
-
-Response:
-{
-  "data": [...],
-  "pagination": {
-    "total": 1250,
-    "limit": 20,
-    "offset": 40,
-    "has_more": true
-  }
-}
-```
-
-**Pros:** Simple, supports random access
-**Cons:** Inconsistent with concurrent inserts/deletes
-
-### Cursor-Based Pagination
-
-```
-GET /users?limit=20&cursor=eyJpZCI6MTIzfQ==
-
-Response:
-{
-  "data": [...],
-  "pagination": {
-    "limit": 20,
-    "next_cursor": "eyJpZCI6MTQzfQ==",
-    "prev_cursor": "eyJpZCI6MTIzfQ==",
-    "has_more": true
-  }
-}
-```
-
-**Pros:** Consistent with real-time data, efficient
-**Cons:** No random access, cursor encoding required
-
-### Implementation Example
-
-```typescript
-// Cursor-based pagination
-interface CursorPagination {
-  limit: number;
-  cursor?: string;
-  direction?: 'forward' | 'backward';
-}
-
-async function paginatedQuery<T>(
-  query: QueryBuilder,
-  { limit, cursor, direction = 'forward' }: CursorPagination
-): Promise<{ data: T[]; nextCursor?: string; hasMore: boolean }> {
-  // Decode cursor
-  const decoded = cursor ? JSON.parse(Buffer.from(cursor, 'base64').toString()) : null;
-
-  // Apply cursor condition
-  if (decoded) {
-    query = direction === 'forward'
-      ? query.where('id', '>', decoded.id)
-      : query.where('id', '<', decoded.id);
-  }
-
-  // Fetch one extra to check if more exist
-  const results = await query.limit(limit + 1).orderBy('id', direction === 'forward' ? 'asc' : 'desc');
-
-  const hasMore = results.length > limit;
-  const data = hasMore ? results.slice(0, -1) : results;
-
-  // Encode next cursor
-  const nextCursor = hasMore
-    ? Buffer.from(JSON.stringify({ id: data[data.length - 1].id })).toString('base64')
-    : undefined;
-
-  return { data, nextCursor, hasMore };
-}
-```
-
----
-
-## 6. Authentication Patterns
-
-### JWT Authentication Flow
-
-```
-┌──────────┐      1. Login        ┌──────────┐
-│  Client  │ ──────────────────▶  │  Server  │
-└──────────┘                      └──────────┘
-                                       │
-     2. Return JWT                     │
-◀────────────────────────────────────────
-     {access_token, refresh_token}     │
-                                       │
-     3. API Request                    │
-───────────────────────────────────────▶
-     Authorization: Bearer {token}     │
-                                       │
-     4. Validate & Respond             │
-◀────────────────────────────────────────
-```
-
-### JWT Implementation
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-interface TokenPayload {
-  userId: string;
-  email: string;
-  roles: string[];
-}
-
-// Generate tokens
-function generateTokens(user: User): { accessToken: string; refreshToken: string } {
-  const payload: TokenPayload = {
-    userId: user.id,
-    email: user.email,
-    roles: user.roles,
-  };
-
-  const accessToken = jwt.sign(payload, process.env.JWT_SECRET!, {
-    expiresIn: '15m',
-    algorithm: 'RS256',
-  });
-
-  const refreshToken = jwt.sign(
-    { userId: user.id, tokenVersion: user.tokenVersion },
-    process.env.JWT_REFRESH_SECRET!,
-    { expiresIn: '7d', algorithm: 'RS256' }
-  );
-
-  return { accessToken, refreshToken };
-}
-
-// Middleware
-const authenticate: RequestHandler = async (req, res, next) => {
-  const authHeader = req.headers.authorization;
-  if (!authHeader?.startsWith('Bearer ')) {
-    return res.status(401).json({ error: { code: 'AUTHENTICATION_REQUIRED' } });
-  }
-
-  try {
-    const token = authHeader.slice(7);
-    const payload = jwt.verify(token, process.env.JWT_SECRET!) as TokenPayload;
-    req.user = payload;
-    next();
-  } catch (err) {
-    if (err instanceof jwt.TokenExpiredError) {
-      return res.status(401).json({ error: { code: 'TOKEN_EXPIRED' } });
-    }
-    return res.status(401).json({ error: { code: 'INVALID_TOKEN' } });
-  }
-};
-```
-
-### API Key Authentication (Service-to-Service)
-
-```typescript
-// API key middleware
-const apiKeyAuth: RequestHandler = async (req, res, next) => {
-  const apiKey = req.headers['x-api-key'] as string;
-
-  if (!apiKey) {
-    return res.status(401).json({ error: { code: 'API_KEY_REQUIRED' } });
-  }
-
-  // Hash and lookup (never store plain API keys)
-  const hashedKey = crypto.createHash('sha256').update(apiKey).digest('hex');
-  const client = await db.apiClients.findByHashedKey(hashedKey);
-
-  if (!client || !client.isActive) {
-    return res.status(401).json({ error: { code: 'INVALID_API_KEY' } });
-  }
-
-  req.apiClient = client;
-  next();
-};
-```
-
----
-
-## 7. Rate Limiting Design
-
-### Rate Limit Headers
-
-```
-HTTP/1.1 200 OK
-X-RateLimit-Limit: 100
-X-RateLimit-Remaining: 95
-X-RateLimit-Reset: 1705312800
-Retry-After: 60
-```
-
-### Tiered Rate Limits
-
-```typescript
-const rateLimits = {
-  anonymous: { requests: 60, window: '1m' },
-  authenticated: { requests: 1000, window: '1h' },
-  premium: { requests: 10000, window: '1h' },
-};
-
-// Implementation with Redis
-import { RateLimiterRedis } from 'rate-limiter-flexible';
-
-const createRateLimiter = (tier: keyof typeof rateLimits) => {
-  const config = rateLimits[tier];
-  return new RateLimiterRedis({
-    storeClient: redisClient,
-    keyPrefix: `ratelimit:${tier}`,
-    points: config.requests,
-    duration: parseDuration(config.window),
-  });
-};
-```
-
-### Rate Limit Response
-
-```json
-{
-  "error": {
-    "code": "RATE_LIMIT_EXCEEDED",
-    "message": "Too many requests",
-    "details": {
-      "limit": 100,
-      "window": "1 minute",
-      "retry_after": 45
-    }
-  }
-}
-```
-
----
-
-## 8. Idempotency Patterns
-
-### Idempotency Key Header
-
-```
-POST /payments
-Idempotency-Key: payment_abc123_attempt1
-Content-Type: application/json
-
-{
-  "amount": 1000,
-  "currency": "USD"
-}
-```
-
-### Implementation
-
-```typescript
-const idempotencyMiddleware: RequestHandler = async (req, res, next) => {
-  const idempotencyKey = req.headers['idempotency-key'] as string;
-
-  if (!idempotencyKey) {
-    return next(); // Optional for some endpoints
-  }
-
-  // Check for existing response
-  const cached = await redis.get(`idempotency:${idempotencyKey}`);
-  if (cached) {
-    const { statusCode, body } = JSON.parse(cached);
-    return res.status(statusCode).json(body);
-  }
-
-  // Store response after processing
-  const originalJson = res.json.bind(res);
-  res.json = (body: any) => {
-    redis.setex(
-      `idempotency:${idempotencyKey}`,
-      86400, // 24 hours
-      JSON.stringify({ statusCode: res.statusCode, body })
-    );
-    return originalJson(body);
-  };
-
-  next();
-};
-```
-
----
-
-## Quick Reference: HTTP Methods
-
-| Method | Idempotent | Safe | Cacheable | Request Body |
-|--------|------------|------|-----------|--------------|
-| GET | Yes | Yes | Yes | No |
-| HEAD | Yes | Yes | Yes | No |
-| POST | No | No | Conditional | Yes |
-| PUT | Yes | No | No | Yes |
-| PATCH | No | No | No | Yes |
-| DELETE | Yes | No | No | Optional |
-| OPTIONS | Yes | Yes | No | No |
diff --git a/.agent/skills/senior-backend/references/backend_security_practices.md b/.agent/skills/senior-backend/references/backend_security_practices.md
deleted file mode 100644
index e07c417..0000000
--- a/.agent/skills/senior-backend/references/backend_security_practices.md
+++ /dev/null
@@ -1,1075 +0,0 @@
-# Backend Security Practices
-
-Security patterns and OWASP Top 10 mitigations for Node.js/Express applications.
-
-## Guide Index
-
-1. [OWASP Top 10 Mitigations](#1-owasp-top-10-mitigations)
-2. [Input Validation](#2-input-validation)
-3. [SQL Injection Prevention](#3-sql-injection-prevention)
-4. [XSS Prevention](#4-xss-prevention)
-5. [Authentication Security](#5-authentication-security)
-6. [Authorization Patterns](#6-authorization-patterns)
-7. [Security Headers](#7-security-headers)
-8. [Secrets Management](#8-secrets-management)
-9. [Logging and Monitoring](#9-logging-and-monitoring)
-
----
-
-## 1. OWASP Top 10 Mitigations
-
-### A01: Broken Access Control
-
-```typescript
-// BAD: Direct object reference
-app.get('/users/:id/profile', async (req, res) => {
-  const user = await db.users.findById(req.params.id);
-  res.json(user); // Anyone can access any user!
-});
-
-// GOOD: Verify ownership
-app.get('/users/:id/profile', authenticate, async (req, res) => {
-  const userId = req.params.id;
-
-  // Verify user can only access their own data
-  if (req.user.id !== userId && !req.user.roles.includes('admin')) {
-    return res.status(403).json({ error: { code: 'FORBIDDEN' } });
-  }
-
-  const user = await db.users.findById(userId);
-  res.json(user);
-});
-```
-
-### A02: Cryptographic Failures
-
-```typescript
-// BAD: Weak hashing
-const hash = crypto.createHash('md5').update(password).digest('hex');
-
-// GOOD: bcrypt with appropriate cost factor
-import bcrypt from 'bcrypt';
-
-const SALT_ROUNDS = 12; // Adjust based on hardware
-
-async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-async function verifyPassword(password: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(password, hash);
-}
-```
-
-### A03: Injection
-
-```typescript
-// BAD: String concatenation in SQL
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-
-// GOOD: Parameterized queries
-const result = await db.query(
-  'SELECT * FROM users WHERE email = $1',
-  [email]
-);
-```
-
-### A04: Insecure Design
-
-```typescript
-// BAD: No rate limiting on sensitive operations
-app.post('/forgot-password', async (req, res) => {
-  await sendResetEmail(req.body.email);
-  res.json({ message: 'If email exists, reset link sent' });
-});
-
-// GOOD: Rate limit + consistent response time
-import rateLimit from 'express-rate-limit';
-
-const passwordResetLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 3, // 3 attempts per 15 minutes
-  skipSuccessfulRequests: false,
-});
-
-app.post('/forgot-password', passwordResetLimiter, async (req, res) => {
-  const startTime = Date.now();
-
-  try {
-    const user = await db.users.findByEmail(req.body.email);
-    if (user) {
-      await sendResetEmail(user.email);
-    }
-  } catch (err) {
-    logger.error(err);
-  }
-
-  // Consistent response time prevents timing attacks
-  const elapsed = Date.now() - startTime;
-  const minDelay = 500;
-  if (elapsed < minDelay) {
-    await sleep(minDelay - elapsed);
-  }
-
-  // Same response regardless of email existence
-  res.json({ message: 'If email exists, reset link sent' });
-});
-```
-
-### A05: Security Misconfiguration
-
-```typescript
-// BAD: Detailed errors in production
-app.use((err, req, res, next) => {
-  res.status(500).json({
-    error: err.message,
-    stack: err.stack, // Exposes internals!
-  });
-});
-
-// GOOD: Environment-aware error handling
-app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
-  const requestId = req.id;
-
-  // Always log full error internally
-  logger.error({ err, requestId }, 'Unhandled error');
-
-  // Return safe response
-  res.status(500).json({
-    error: {
-      code: 'INTERNAL_ERROR',
-      message: process.env.NODE_ENV === 'development'
-        ? err.message
-        : 'An unexpected error occurred',
-      requestId,
-    },
-  });
-});
-```
-
-### A06: Vulnerable Components
-
-```bash
-# Check for vulnerabilities
-npm audit
-
-# Fix automatically where possible
-npm audit fix
-
-# Check specific package
-npm audit --package-lock-only
-
-# Use Snyk for deeper analysis
-npx snyk test
-```
-
-```typescript
-// Automated dependency updates (package.json)
-{
-  "scripts": {
-    "security:audit": "npm audit --audit-level=high",
-    "security:check": "snyk test",
-    "preinstall": "npm audit"
-  }
-}
-```
-
-### A07: Authentication Failures
-
-```typescript
-// BAD: Weak session management
-app.post('/login', async (req, res) => {
-  const user = await authenticate(req.body);
-  req.session.userId = user.id; // Session fixation risk
-  res.json({ success: true });
-});
-
-// GOOD: Regenerate session on authentication
-app.post('/login', async (req, res) => {
-  const user = await authenticate(req.body);
-
-  // Regenerate session to prevent fixation
-  req.session.regenerate((err) => {
-    if (err) return next(err);
-
-    req.session.userId = user.id;
-    req.session.createdAt = Date.now();
-
-    req.session.save((err) => {
-      if (err) return next(err);
-      res.json({ success: true });
-    });
-  });
-});
-```
-
-### A08: Software and Data Integrity Failures
-
-```typescript
-// Verify webhook signatures (e.g., Stripe)
-import Stripe from 'stripe';
-
-app.post('/webhooks/stripe',
-  express.raw({ type: 'application/json' }),
-  async (req, res) => {
-    const sig = req.headers['stripe-signature'] as string;
-    const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET!;
-
-    let event: Stripe.Event;
-
-    try {
-      event = stripe.webhooks.constructEvent(
-        req.body,
-        sig,
-        endpointSecret
-      );
-    } catch (err) {
-      logger.warn({ err }, 'Webhook signature verification failed');
-      return res.status(400).json({ error: 'Invalid signature' });
-    }
-
-    // Process verified event
-    await handleStripeEvent(event);
-    res.json({ received: true });
-  }
-);
-```
-
-### A09: Security Logging Failures
-
-```typescript
-// Comprehensive security logging
-import pino from 'pino';
-
-const logger = pino({
-  level: process.env.LOG_LEVEL || 'info',
-  redact: ['req.headers.authorization', 'req.body.password'], // Redact sensitive
-});
-
-// Log security events
-function logSecurityEvent(event: {
-  type: 'LOGIN_SUCCESS' | 'LOGIN_FAILURE' | 'ACCESS_DENIED' | 'SUSPICIOUS_ACTIVITY';
-  userId?: string;
-  ip: string;
-  userAgent: string;
-  details?: Record<string, unknown>;
-}) {
-  logger.info({
-    security: true,
-    ...event,
-    timestamp: new Date().toISOString(),
-  }, `Security event: ${event.type}`);
-}
-
-// Usage
-app.post('/login', async (req, res) => {
-  try {
-    const user = await authenticate(req.body);
-    logSecurityEvent({
-      type: 'LOGIN_SUCCESS',
-      userId: user.id,
-      ip: req.ip,
-      userAgent: req.headers['user-agent'] || '',
-    });
-    // ...
-  } catch (err) {
-    logSecurityEvent({
-      type: 'LOGIN_FAILURE',
-      ip: req.ip,
-      userAgent: req.headers['user-agent'] || '',
-      details: { email: req.body.email },
-    });
-    // ...
-  }
-});
-```
-
-### A10: Server-Side Request Forgery (SSRF)
-
-```typescript
-// BAD: Unvalidated URL fetch
-app.post('/fetch-url', async (req, res) => {
-  const response = await fetch(req.body.url); // SSRF vulnerability!
-  res.json({ data: await response.text() });
-});
-
-// GOOD: URL allowlist and validation
-import { URL } from 'url';
-
-const ALLOWED_HOSTS = ['api.example.com', 'cdn.example.com'];
-
-function isAllowedUrl(urlString: string): boolean {
-  try {
-    const url = new URL(urlString);
-
-    // Block internal IPs
-    const blockedPatterns = [
-      /^localhost$/i,
-      /^127\./,
-      /^10\./,
-      /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
-      /^192\.168\./,
-      /^0\./,
-      /^169\.254\./,
-      /^\[::1\]$/,
-      /^metadata\.google\.internal$/,
-      /^169\.254\.169\.254$/,
-    ];
-
-    if (blockedPatterns.some(p => p.test(url.hostname))) {
-      return false;
-    }
-
-    // Only allow HTTPS
-    if (url.protocol !== 'https:') {
-      return false;
-    }
-
-    // Check allowlist
-    return ALLOWED_HOSTS.includes(url.hostname);
-  } catch {
-    return false;
-  }
-}
-
-app.post('/fetch-url', async (req, res) => {
-  const { url } = req.body;
-
-  if (!isAllowedUrl(url)) {
-    return res.status(400).json({ error: { code: 'INVALID_URL' } });
-  }
-
-  const response = await fetch(url, {
-    timeout: 5000,
-    follow: 0, // Don't follow redirects
-  });
-
-  res.json({ data: await response.text() });
-});
-```
-
----
-
-## 2. Input Validation
-
-### Schema Validation with Zod
-
-```typescript
-import { z } from 'zod';
-
-// Define schemas
-const CreateUserSchema = z.object({
-  email: z.string().email().max(255).toLowerCase(),
-  password: z.string()
-    .min(8, 'Password must be at least 8 characters')
-    .max(72, 'Password must be at most 72 characters') // bcrypt limit
-    .regex(/[A-Z]/, 'Password must contain uppercase letter')
-    .regex(/[a-z]/, 'Password must contain lowercase letter')
-    .regex(/[0-9]/, 'Password must contain number'),
-  name: z.string().min(1).max(100).trim(),
-  age: z.number().int().min(18).max(120).optional(),
-});
-
-const PaginationSchema = z.object({
-  limit: z.coerce.number().int().min(1).max(100).default(20),
-  offset: z.coerce.number().int().min(0).default(0),
-  sort: z.enum(['asc', 'desc']).default('desc'),
-});
-
-// Validation middleware
-function validate<T>(schema: z.ZodSchema<T>) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    const result = schema.safeParse(req.body);
-
-    if (!result.success) {
-      const details = result.error.errors.map(err => ({
-        field: err.path.join('.'),
-        code: err.code,
-        message: err.message,
-      }));
-
-      return res.status(400).json({
-        error: {
-          code: 'VALIDATION_ERROR',
-          message: 'Request validation failed',
-          details,
-        },
-      });
-    }
-
-    req.body = result.data;
-    next();
-  };
-}
-
-// Usage
-app.post('/users', validate(CreateUserSchema), async (req, res) => {
-  // req.body is now typed and validated
-  const user = await userService.create(req.body);
-  res.status(201).json(user);
-});
-```
-
-### Sanitization
-
-```typescript
-import DOMPurify from 'isomorphic-dompurify';
-import xss from 'xss';
-
-// HTML sanitization for rich text fields
-function sanitizeHtml(dirty: string): string {
-  return DOMPurify.sanitize(dirty, {
-    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],
-    ALLOWED_ATTR: ['href'],
-  });
-}
-
-// Plain text sanitization (strip all HTML)
-function sanitizePlainText(dirty: string): string {
-  return xss(dirty, {
-    whiteList: {},
-    stripIgnoreTag: true,
-    stripIgnoreTagBody: ['script'],
-  });
-}
-
-// File path sanitization
-import path from 'path';
-
-function sanitizePath(userPath: string, baseDir: string): string | null {
-  const resolved = path.resolve(baseDir, userPath);
-
-  // Prevent directory traversal
-  if (!resolved.startsWith(baseDir)) {
-    return null;
-  }
-
-  return resolved;
-}
-```
-
----
-
-## 3. SQL Injection Prevention
-
-### Parameterized Queries
-
-```typescript
-// BAD: String interpolation
-const email = "'; DROP TABLE users; --";
-db.query(`SELECT * FROM users WHERE email = '${email}'`);
-
-// GOOD: Parameterized query (pg)
-const result = await db.query(
-  'SELECT * FROM users WHERE email = $1',
-  [email]
-);
-
-// GOOD: Parameterized query (mysql2)
-const [rows] = await connection.execute(
-  'SELECT * FROM users WHERE email = ?',
-  [email]
-);
-```
-
-### Query Builders
-
-```typescript
-// Using Knex.js
-const users = await knex('users')
-  .where('email', email) // Automatically parameterized
-  .andWhere('status', 'active')
-  .select('id', 'name', 'email');
-
-// Dynamic WHERE with safe column names
-const ALLOWED_COLUMNS = ['name', 'email', 'created_at'] as const;
-
-function buildUserQuery(filters: Record<string, string>) {
-  let query = knex('users').select('id', 'name', 'email');
-
-  for (const [column, value] of Object.entries(filters)) {
-    // Validate column name against allowlist
-    if (ALLOWED_COLUMNS.includes(column as any)) {
-      query = query.where(column, value);
-    }
-  }
-
-  return query;
-}
-```
-
-### ORM Safety
-
-```typescript
-// Prisma (safe by default)
-const user = await prisma.user.findUnique({
-  where: { email }, // Automatically escaped
-});
-
-// TypeORM (safe by default)
-const user = await userRepository.findOne({
-  where: { email }, // Automatically escaped
-});
-
-// DANGER: Raw queries still require parameterization
-// BAD
-await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE email = '${email}'`);
-
-// GOOD
-await prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;
-```
-
----
-
-## 4. XSS Prevention
-
-### Output Encoding
-
-```typescript
-// Server-side template rendering (EJS)
-// In template: <%= userInput %> (escaped)
-// NOT: <%- userInput %> (raw, dangerous)
-
-// Manual HTML encoding
-function escapeHtml(str: string): string {
-  return str
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
-
-// JSON response (automatically safe in modern frameworks)
-res.json({ message: userInput }); // JSON.stringify escapes by default
-```
-
-### Content Security Policy
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet.contentSecurityPolicy({
-  directives: {
-    defaultSrc: ["'self'"],
-    scriptSrc: ["'self'", "'strict-dynamic'"],
-    styleSrc: ["'self'", "'unsafe-inline'"], // Consider using nonces
-    imgSrc: ["'self'", "data:", "https:"],
-    fontSrc: ["'self'"],
-    objectSrc: ["'none'"],
-    frameAncestors: ["'none'"],
-    baseUri: ["'self'"],
-    formAction: ["'self'"],
-    upgradeInsecureRequests: [],
-  },
-}));
-```
-
-### API Response Safety
-
-```typescript
-// Set correct Content-Type for JSON APIs
-app.use((req, res, next) => {
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  next();
-});
-
-// Disable JSONP (if not needed)
-// Don't implement callback parameter handling
-
-// Safe JSON response
-res.json({
-  data: sanitizedData,
-  // Never reflect raw user input
-});
-```
-
----
-
-## 5. Authentication Security
-
-### Password Storage
-
-```typescript
-import bcrypt from 'bcrypt';
-import { randomBytes } from 'crypto';
-
-const SALT_ROUNDS = 12;
-
-async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-async function verifyPassword(password: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(password, hash);
-}
-
-// For password reset tokens
-function generateSecureToken(): string {
-  return randomBytes(32).toString('hex');
-}
-
-// Token expiration (store in DB)
-interface PasswordResetToken {
-  token: string; // Hashed
-  userId: string;
-  expiresAt: Date; // 1 hour from creation
-}
-```
-
-### JWT Best Practices
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-// Use asymmetric keys in production
-const PRIVATE_KEY = process.env.JWT_PRIVATE_KEY!;
-const PUBLIC_KEY = process.env.JWT_PUBLIC_KEY!;
-
-interface AccessTokenPayload {
-  sub: string; // User ID
-  email: string;
-  roles: string[];
-  iat: number;
-  exp: number;
-}
-
-function generateAccessToken(user: User): string {
-  const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {
-    sub: user.id,
-    email: user.email,
-    roles: user.roles,
-  };
-
-  return jwt.sign(payload, PRIVATE_KEY, {
-    algorithm: 'RS256',
-    expiresIn: '15m',
-    issuer: 'api.example.com',
-    audience: 'example.com',
-  });
-}
-
-function verifyAccessToken(token: string): AccessTokenPayload {
-  return jwt.verify(token, PUBLIC_KEY, {
-    algorithms: ['RS256'],
-    issuer: 'api.example.com',
-    audience: 'example.com',
-  }) as AccessTokenPayload;
-}
-
-// Refresh tokens should be stored in DB and rotated
-interface RefreshToken {
-  id: string;
-  token: string; // Hashed
-  userId: string;
-  expiresAt: Date;
-  family: string; // For rotation detection
-  isRevoked: boolean;
-}
-```
-
-### Session Management
-
-```typescript
-import session from 'express-session';
-import RedisStore from 'connect-redis';
-import { createClient } from 'redis';
-
-const redisClient = createClient({ url: process.env.REDIS_URL });
-
-app.use(session({
-  store: new RedisStore({ client: redisClient }),
-  name: 'sessionId', // Don't use default 'connect.sid'
-  secret: process.env.SESSION_SECRET!,
-  resave: false,
-  saveUninitialized: false,
-  cookie: {
-    secure: process.env.NODE_ENV === 'production',
-    httpOnly: true,
-    sameSite: 'strict',
-    maxAge: 24 * 60 * 60 * 1000, // 24 hours
-    domain: process.env.COOKIE_DOMAIN,
-  },
-}));
-
-// Regenerate session on privilege change
-async function elevateSession(req: Request): Promise<void> {
-  return new Promise((resolve, reject) => {
-    const userId = req.session.userId;
-    req.session.regenerate((err) => {
-      if (err) return reject(err);
-      req.session.userId = userId;
-      req.session.elevated = true;
-      req.session.elevatedAt = Date.now();
-      resolve();
-    });
-  });
-}
-```
-
----
-
-## 6. Authorization Patterns
-
-### Role-Based Access Control (RBAC)
-
-```typescript
-type Role = 'user' | 'moderator' | 'admin';
-type Permission = 'read:users' | 'write:users' | 'delete:users' | 'read:admin';
-
-const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
-  user: ['read:users'],
-  moderator: ['read:users', 'write:users'],
-  admin: ['read:users', 'write:users', 'delete:users', 'read:admin'],
-};
-
-function hasPermission(userRoles: Role[], required: Permission): boolean {
-  return userRoles.some(role =>
-    ROLE_PERMISSIONS[role]?.includes(required)
-  );
-}
-
-// Middleware
-function requirePermission(permission: Permission) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    if (!hasPermission(req.user.roles, permission)) {
-      return res.status(403).json({
-        error: { code: 'FORBIDDEN', message: 'Insufficient permissions' },
-      });
-    }
-    next();
-  };
-}
-
-// Usage
-app.delete('/users/:id',
-  authenticate,
-  requirePermission('delete:users'),
-  deleteUserHandler
-);
-```
-
-### Attribute-Based Access Control (ABAC)
-
-```typescript
-interface AccessContext {
-  user: { id: string; roles: string[]; department: string };
-  resource: { ownerId: string; department: string; sensitivity: string };
-  action: 'read' | 'write' | 'delete';
-  environment: { time: Date; ip: string };
-}
-
-interface Policy {
-  name: string;
-  condition: (ctx: AccessContext) => boolean;
-}
-
-const policies: Policy[] = [
-  {
-    name: 'owner-full-access',
-    condition: (ctx) => ctx.resource.ownerId === ctx.user.id,
-  },
-  {
-    name: 'same-department-read',
-    condition: (ctx) =>
-      ctx.action === 'read' &&
-      ctx.resource.department === ctx.user.department,
-  },
-  {
-    name: 'admin-override',
-    condition: (ctx) => ctx.user.roles.includes('admin'),
-  },
-  {
-    name: 'no-sensitive-outside-hours',
-    condition: (ctx) => {
-      const hour = ctx.environment.time.getHours();
-      return ctx.resource.sensitivity !== 'high' || (hour >= 9 && hour <= 17);
-    },
-  },
-];
-
-function evaluateAccess(ctx: AccessContext): boolean {
-  return policies.some(policy => policy.condition(ctx));
-}
-```
-
----
-
-## 7. Security Headers
-
-### Complete Helmet Configuration
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet({
-  // Content Security Policy
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "https://api.example.com"],
-      fontSrc: ["'self'"],
-      objectSrc: ["'none'"],
-      mediaSrc: ["'none'"],
-      frameSrc: ["'none'"],
-    },
-  },
-  // Strict Transport Security
-  hsts: {
-    maxAge: 31536000,
-    includeSubDomains: true,
-    preload: true,
-  },
-  // Prevent clickjacking
-  frameguard: { action: 'deny' },
-  // Prevent MIME sniffing
-  noSniff: true,
-  // XSS filter (legacy browsers)
-  xssFilter: true,
-  // Hide X-Powered-By
-  hidePoweredBy: true,
-  // Referrer policy
-  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-  // Cross-origin policies
-  crossOriginEmbedderPolicy: false, // Enable if using SharedArrayBuffer
-  crossOriginOpenerPolicy: { policy: 'same-origin' },
-  crossOriginResourcePolicy: { policy: 'same-origin' },
-}));
-
-// CORS configuration
-import cors from 'cors';
-
-app.use(cors({
-  origin: ['https://example.com', 'https://app.example.com'],
-  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-  credentials: true,
-  maxAge: 86400, // 24 hours
-}));
-```
-
-### Header Reference
-
-| Header | Purpose | Value |
-|--------|---------|-------|
-| `Strict-Transport-Security` | Force HTTPS | `max-age=31536000; includeSubDomains; preload` |
-| `Content-Security-Policy` | Prevent XSS | See above |
-| `X-Content-Type-Options` | Prevent MIME sniffing | `nosniff` |
-| `X-Frame-Options` | Prevent clickjacking | `DENY` |
-| `Referrer-Policy` | Control referrer info | `strict-origin-when-cross-origin` |
-| `Permissions-Policy` | Feature restrictions | `geolocation=(), microphone=()` |
-
----
-
-## 8. Secrets Management
-
-### Environment Variables
-
-```typescript
-// config/secrets.ts
-import { z } from 'zod';
-
-const SecretsSchema = z.object({
-  DATABASE_URL: z.string().url(),
-  JWT_SECRET: z.string().min(32),
-  JWT_PRIVATE_KEY: z.string(),
-  JWT_PUBLIC_KEY: z.string(),
-  REDIS_URL: z.string().url(),
-  STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
-  STRIPE_WEBHOOK_SECRET: z.string().startsWith('whsec_'),
-});
-
-// Validate on startup
-export const secrets = SecretsSchema.parse(process.env);
-
-// NEVER log secrets
-console.log('Config loaded:', {
-  database: secrets.DATABASE_URL.replace(/\/\/.*@/, '//***@'),
-  redis: 'configured',
-  stripe: 'configured',
-});
-```
-
-### Secret Rotation
-
-```typescript
-// Support multiple keys during rotation
-const JWT_SECRETS = [
-  process.env.JWT_SECRET_CURRENT!,
-  process.env.JWT_SECRET_PREVIOUS!, // Keep for grace period
-].filter(Boolean);
-
-function verifyTokenWithRotation(token: string): TokenPayload | null {
-  for (const secret of JWT_SECRETS) {
-    try {
-      return jwt.verify(token, secret) as TokenPayload;
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-```
-
-### Vault Integration
-
-```typescript
-import Vault from 'node-vault';
-
-const vault = Vault({
-  endpoint: process.env.VAULT_ADDR,
-  token: process.env.VAULT_TOKEN,
-});
-
-async function getSecret(path: string): Promise<string> {
-  const result = await vault.read(`secret/data/${path}`);
-  return result.data.data.value;
-}
-
-// Cache secrets with TTL
-const secretsCache = new Map<string, { value: string; expiresAt: number }>();
-const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-
-async function getCachedSecret(path: string): Promise<string> {
-  const cached = secretsCache.get(path);
-  if (cached && cached.expiresAt > Date.now()) {
-    return cached.value;
-  }
-
-  const value = await getSecret(path);
-  secretsCache.set(path, { value, expiresAt: Date.now() + CACHE_TTL });
-  return value;
-}
-```
-
----
-
-## 9. Logging and Monitoring
-
-### Security Event Logging
-
-```typescript
-import pino from 'pino';
-
-const logger = pino({
-  level: 'info',
-  redact: {
-    paths: [
-      'req.headers.authorization',
-      'req.headers.cookie',
-      'req.body.password',
-      'req.body.token',
-      '*.password',
-      '*.secret',
-      '*.apiKey',
-    ],
-    censor: '[REDACTED]',
-  },
-});
-
-// Security event types
-type SecurityEventType =
-  | 'AUTH_SUCCESS'
-  | 'AUTH_FAILURE'
-  | 'AUTH_LOCKOUT'
-  | 'PASSWORD_CHANGED'
-  | 'PASSWORD_RESET_REQUEST'
-  | 'PERMISSION_DENIED'
-  | 'RATE_LIMIT_EXCEEDED'
-  | 'SUSPICIOUS_ACTIVITY'
-  | 'TOKEN_REVOKED';
-
-interface SecurityEvent {
-  type: SecurityEventType;
-  userId?: string;
-  ip: string;
-  userAgent: string;
-  path: string;
-  details?: Record<string, unknown>;
-}
-
-function logSecurityEvent(event: SecurityEvent): void {
-  logger.info({
-    security: true,
-    ...event,
-    timestamp: new Date().toISOString(),
-  }, `Security: ${event.type}`);
-}
-```
-
-### Request Logging
-
-```typescript
-import pinoHttp from 'pino-http';
-
-app.use(pinoHttp({
-  logger,
-  genReqId: (req) => req.headers['x-request-id'] || crypto.randomUUID(),
-  serializers: {
-    req: (req) => ({
-      id: req.id,
-      method: req.method,
-      url: req.url,
-      remoteAddress: req.remoteAddress,
-      // Don't log headers by default (may contain sensitive data)
-    }),
-    res: (res) => ({
-      statusCode: res.statusCode,
-    }),
-  },
-  customLogLevel: (req, res, err) => {
-    if (res.statusCode >= 500 || err) return 'error';
-    if (res.statusCode >= 400) return 'warn';
-    return 'info';
-  },
-}));
-```
-
-### Alerting Thresholds
-
-| Metric | Warning | Critical |
-|--------|---------|----------|
-| Failed logins per IP (15 min) | > 5 | > 10 |
-| Failed logins per account (1 hour) | > 3 | > 5 |
-| 403 responses per IP (5 min) | > 10 | > 50 |
-| 500 errors (5 min) | > 5 | > 20 |
-| Request rate per IP (1 min) | > 100 | > 500 |
-
----
-
-## Quick Reference: Security Checklist
-
-### Authentication
-- [ ] bcrypt with cost >= 12 for password hashing
-- [ ] JWT with RS256, short expiry (15-30 min)
-- [ ] Refresh token rotation with family detection
-- [ ] Session regeneration on login
-- [ ] Secure cookie flags (httpOnly, secure, sameSite)
-
-### Input Validation
-- [ ] Schema validation on all inputs (Zod)
-- [ ] Parameterized queries (never string concat)
-- [ ] File path sanitization
-- [ ] Content-Type validation
-
-### Headers
-- [ ] Strict-Transport-Security
-- [ ] Content-Security-Policy
-- [ ] X-Content-Type-Options: nosniff
-- [ ] X-Frame-Options: DENY
-- [ ] CORS with specific origins
-
-### Logging
-- [ ] Redact sensitive fields
-- [ ] Log security events
-- [ ] Include request IDs
-- [ ] Alert on anomalies
-
-### Dependencies
-- [ ] npm audit in CI
-- [ ] Automated dependency updates
-- [ ] Lock file committed
diff --git a/.agent/skills/senior-backend/references/database_optimization_guide.md b/.agent/skills/senior-backend/references/database_optimization_guide.md
deleted file mode 100644
index 03412ed..0000000
--- a/.agent/skills/senior-backend/references/database_optimization_guide.md
+++ /dev/null
@@ -1,593 +0,0 @@
-# Database Optimization Guide
-
-Practical strategies for PostgreSQL query optimization, indexing, and performance tuning.
-
-## Guide Index
-
-1. [Query Analysis with EXPLAIN](#1-query-analysis-with-explain)
-2. [Indexing Strategies](#2-indexing-strategies)
-3. [N+1 Query Problem](#3-n1-query-problem)
-4. [Connection Pooling](#4-connection-pooling)
-5. [Query Optimization Patterns](#5-query-optimization-patterns)
-6. [Database Migrations](#6-database-migrations)
-7. [Monitoring and Alerting](#7-monitoring-and-alerting)
-
----
-
-## 1. Query Analysis with EXPLAIN
-
-### Basic EXPLAIN Usage
-
-```sql
--- Show query plan
-EXPLAIN SELECT * FROM orders WHERE user_id = 123;
-
--- Show plan with actual execution times
-EXPLAIN ANALYZE SELECT * FROM orders WHERE user_id = 123;
-
--- Show buffers and I/O statistics
-EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT)
-SELECT * FROM orders WHERE user_id = 123;
-```
-
-### Reading EXPLAIN Output
-
-```
-                                    QUERY PLAN
----------------------------------------------------------------------------
- Index Scan using idx_orders_user_id on orders  (cost=0.43..8.45 rows=10 width=120)
-   Index Cond: (user_id = 123)
-   Buffers: shared hit=3
- Planning Time: 0.152 ms
- Execution Time: 0.089 ms
-```
-
-**Key metrics:**
-- `cost`: Estimated cost (startup..total)
-- `rows`: Estimated row count
-- `width`: Average row size in bytes
-- `actual time`: Real execution time (with ANALYZE)
-- `Buffers: shared hit`: Pages read from cache
-
-### Scan Types (Best to Worst)
-
-| Scan Type | Description | Performance |
-|-----------|-------------|-------------|
-| Index Only Scan | Data from index alone | Best |
-| Index Scan | Index lookup + heap fetch | Good |
-| Bitmap Index Scan | Multiple index conditions | Good |
-| Index Scan + Filter | Index + row filtering | Okay |
-| Seq Scan (small table) | Full table scan | Okay |
-| Seq Scan (large table) | Full table scan | Bad |
-| Nested Loop (large) | O(n*m) join | Very Bad |
-
-### Warning Signs
-
-```sql
--- BAD: Sequential scan on large table
-Seq Scan on orders  (cost=0.00..1854231.00 rows=50000000 width=120)
-  Filter: (status = 'pending')
-  Rows Removed by Filter: 49500000
-
--- BAD: Nested loop with high iterations
-Nested Loop  (cost=0.43..2847593.20 rows=12500000 width=240)
-  ->  Seq Scan on users  (cost=0.00..1250.00 rows=50000 width=120)
-  ->  Index Scan on orders  (cost=0.43..45.73 rows=250 width=120)
-       Index Cond: (orders.user_id = users.id)
-```
-
----
-
-## 2. Indexing Strategies
-
-### Index Types
-
-```sql
--- B-tree (default, most common)
-CREATE INDEX idx_users_email ON users(email);
-
--- Hash (equality only, rarely better than B-tree)
-CREATE INDEX idx_users_id_hash ON users USING hash(id);
-
--- GIN (arrays, JSONB, full-text search)
-CREATE INDEX idx_products_tags ON products USING gin(tags);
-CREATE INDEX idx_users_data ON users USING gin(metadata jsonb_path_ops);
-
--- GiST (geometric, range types, full-text)
-CREATE INDEX idx_locations_point ON locations USING gist(coordinates);
-```
-
-### Composite Indexes
-
-```sql
--- Order matters! Column with = first, then range/sort
-CREATE INDEX idx_orders_user_status_date
-ON orders(user_id, status, created_at DESC);
-
--- This index supports:
--- WHERE user_id = ?
--- WHERE user_id = ? AND status = ?
--- WHERE user_id = ? AND status = ? ORDER BY created_at DESC
--- WHERE user_id = ? ORDER BY created_at DESC
-
--- This index does NOT efficiently support:
--- WHERE status = ? (user_id not in query)
--- WHERE created_at > ? (leftmost column not in query)
-```
-
-### Partial Indexes
-
-```sql
--- Index only active users (smaller, faster)
-CREATE INDEX idx_users_active_email
-ON users(email)
-WHERE status = 'active';
-
--- Index only recent orders
-CREATE INDEX idx_orders_recent
-ON orders(created_at DESC)
-WHERE created_at > CURRENT_DATE - INTERVAL '90 days';
-
--- Index only unprocessed items
-CREATE INDEX idx_queue_pending
-ON job_queue(priority DESC, created_at)
-WHERE processed_at IS NULL;
-```
-
-### Covering Indexes (Index-Only Scans)
-
-```sql
--- Include non-indexed columns to avoid heap lookup
-CREATE INDEX idx_users_email_covering
-ON users(email)
-INCLUDE (name, created_at);
-
--- Query can be satisfied from index alone
-SELECT name, created_at FROM users WHERE email = 'test@example.com';
--- Result: Index Only Scan
-```
-
-### Index Maintenance
-
-```sql
--- Check index usage
-SELECT
-    schemaname,
-    tablename,
-    indexname,
-    idx_scan,
-    idx_tup_read,
-    idx_tup_fetch,
-    pg_size_pretty(pg_relation_size(indexrelid)) as size
-FROM pg_stat_user_indexes
-ORDER BY idx_scan ASC;
-
--- Find unused indexes (candidates for removal)
-SELECT indexrelid::regclass as index,
-       relid::regclass as table,
-       pg_size_pretty(pg_relation_size(indexrelid)) as size
-FROM pg_stat_user_indexes
-WHERE idx_scan = 0
-  AND indexrelid NOT IN (SELECT conindid FROM pg_constraint);
-
--- Rebuild bloated indexes
-REINDEX INDEX CONCURRENTLY idx_orders_user_id;
-```
-
----
-
-## 3. N+1 Query Problem
-
-### The Problem
-
-```typescript
-// BAD: N+1 queries
-const users = await db.query('SELECT * FROM users LIMIT 100');
-
-for (const user of users) {
-  // This runs 100 times!
-  const orders = await db.query(
-    'SELECT * FROM orders WHERE user_id = $1',
-    [user.id]
-  );
-  user.orders = orders;
-}
-// Total queries: 1 + 100 = 101
-```
-
-### Solution 1: JOIN
-
-```typescript
-// GOOD: Single query with JOIN
-const usersWithOrders = await db.query(`
-  SELECT u.*, o.id as order_id, o.total, o.status
-  FROM users u
-  LEFT JOIN orders o ON o.user_id = u.id
-  LIMIT 100
-`);
-// Total queries: 1
-```
-
-### Solution 2: Batch Loading (DataLoader pattern)
-
-```typescript
-// GOOD: Two queries with batch loading
-const users = await db.query('SELECT * FROM users LIMIT 100');
-const userIds = users.map(u => u.id);
-
-const orders = await db.query(
-  'SELECT * FROM orders WHERE user_id = ANY($1)',
-  [userIds]
-);
-
-// Group orders by user_id
-const ordersByUser = groupBy(orders, 'user_id');
-users.forEach(user => {
-  user.orders = ordersByUser[user.id] || [];
-});
-// Total queries: 2
-```
-
-### Solution 3: ORM Eager Loading
-
-```typescript
-// Prisma
-const users = await prisma.user.findMany({
-  take: 100,
-  include: { orders: true }
-});
-
-// TypeORM
-const users = await userRepository.find({
-  take: 100,
-  relations: ['orders']
-});
-
-// Sequelize
-const users = await User.findAll({
-  limit: 100,
-  include: [{ model: Order }]
-});
-```
-
-### Detecting N+1 in Production
-
-```typescript
-// Query logging middleware
-let queryCount = 0;
-const originalQuery = db.query;
-
-db.query = async (...args) => {
-  queryCount++;
-  if (queryCount > 10) {
-    console.warn(`High query count: ${queryCount} in single request`);
-    console.trace();
-  }
-  return originalQuery.apply(db, args);
-};
-```
-
----
-
-## 4. Connection Pooling
-
-### Why Pooling Matters
-
-```
-Without pooling:
-Request → Create connection → Query → Close connection
-         (50-100ms overhead)
-
-With pooling:
-Request → Get connection from pool → Query → Return to pool
-         (0-1ms overhead)
-```
-
-### pg-pool Configuration
-
-```typescript
-import { Pool } from 'pg';
-
-const pool = new Pool({
-  host: process.env.DB_HOST,
-  port: 5432,
-  database: process.env.DB_NAME,
-  user: process.env.DB_USER,
-  password: process.env.DB_PASSWORD,
-
-  // Pool settings
-  min: 5,                    // Minimum connections
-  max: 20,                   // Maximum connections
-  idleTimeoutMillis: 30000,  // Close idle connections after 30s
-  connectionTimeoutMillis: 5000, // Fail if can't connect in 5s
-
-  // Statement timeout (cancel long queries)
-  statement_timeout: 30000,
-});
-
-// Health check
-pool.on('error', (err, client) => {
-  console.error('Unexpected pool error', err);
-});
-```
-
-### Pool Sizing Formula
-
-```
-Optimal connections = (CPU cores * 2) + effective_spindle_count
-
-For SSD with 4 cores:
-connections = (4 * 2) + 1 = 9
-
-For multiple app servers:
-connections_per_server = total_connections / num_servers
-```
-
-### PgBouncer for High Scale
-
-```ini
-# pgbouncer.ini
-[databases]
-mydb = host=localhost port=5432 dbname=mydb
-
-[pgbouncer]
-listen_port = 6432
-listen_addr = 0.0.0.0
-auth_type = md5
-auth_file = /etc/pgbouncer/userlist.txt
-pool_mode = transaction
-max_client_conn = 1000
-default_pool_size = 20
-reserve_pool_size = 5
-```
-
----
-
-## 5. Query Optimization Patterns
-
-### Pagination Optimization
-
-```sql
--- BAD: OFFSET is slow for large values
-SELECT * FROM orders ORDER BY created_at DESC LIMIT 20 OFFSET 10000;
--- Must scan 10,020 rows, discard 10,000
-
--- GOOD: Cursor-based pagination
-SELECT * FROM orders
-WHERE created_at < '2024-01-15T10:00:00Z'
-ORDER BY created_at DESC
-LIMIT 20;
--- Only scans 20 rows
-```
-
-### Batch Updates
-
-```sql
--- BAD: Individual updates
-UPDATE orders SET status = 'shipped' WHERE id = 1;
-UPDATE orders SET status = 'shipped' WHERE id = 2;
--- ...repeat 1000 times
-
--- GOOD: Batch update
-UPDATE orders
-SET status = 'shipped'
-WHERE id = ANY(ARRAY[1, 2, 3, ...1000]);
-
--- GOOD: Update from values
-UPDATE orders o
-SET status = v.new_status
-FROM (VALUES
-  (1, 'shipped'),
-  (2, 'delivered'),
-  (3, 'cancelled')
-) AS v(id, new_status)
-WHERE o.id = v.id;
-```
-
-### Avoiding SELECT *
-
-```sql
--- BAD: Fetches all columns including large text/blob
-SELECT * FROM articles WHERE published = true;
-
--- GOOD: Only fetch needed columns
-SELECT id, title, summary, author_id, published_at
-FROM articles
-WHERE published = true;
-```
-
-### Using EXISTS vs IN
-
-```sql
--- For checking existence, EXISTS is often faster
--- BAD
-SELECT * FROM users
-WHERE id IN (SELECT user_id FROM orders WHERE total > 1000);
-
--- GOOD (for large subquery results)
-SELECT * FROM users u
-WHERE EXISTS (
-  SELECT 1 FROM orders o
-  WHERE o.user_id = u.id AND o.total > 1000
-);
-```
-
-### Materialized Views for Complex Aggregations
-
-```sql
--- Create materialized view for expensive aggregations
-CREATE MATERIALIZED VIEW daily_sales_summary AS
-SELECT
-  date_trunc('day', created_at) as date,
-  product_id,
-  COUNT(*) as order_count,
-  SUM(quantity) as total_quantity,
-  SUM(total) as total_revenue
-FROM orders
-GROUP BY date_trunc('day', created_at), product_id;
-
--- Create index on materialized view
-CREATE INDEX idx_daily_sales_date ON daily_sales_summary(date);
-
--- Refresh periodically
-REFRESH MATERIALIZED VIEW CONCURRENTLY daily_sales_summary;
-```
-
----
-
-## 6. Database Migrations
-
-### Migration Best Practices
-
-```sql
--- Always include rollback
--- migrations/20240115_001_add_user_status.sql
--- UP
-ALTER TABLE users ADD COLUMN status VARCHAR(20) DEFAULT 'active';
-CREATE INDEX CONCURRENTLY idx_users_status ON users(status);
-
--- DOWN (in separate file or comment)
-DROP INDEX CONCURRENTLY IF EXISTS idx_users_status;
-ALTER TABLE users DROP COLUMN IF EXISTS status;
-```
-
-### Safe Column Addition
-
-```sql
--- SAFE: Add nullable column (no table rewrite)
-ALTER TABLE users ADD COLUMN phone VARCHAR(20);
-
--- SAFE: Add column with volatile default (PG 11+)
-ALTER TABLE users ADD COLUMN created_at TIMESTAMP DEFAULT NOW();
-
--- UNSAFE: Add column with constant default (table rewrite before PG 11)
--- ALTER TABLE users ADD COLUMN score INTEGER DEFAULT 0;
-
--- SAFE alternative for constant default:
-ALTER TABLE users ADD COLUMN score INTEGER;
-UPDATE users SET score = 0 WHERE score IS NULL;
-ALTER TABLE users ALTER COLUMN score SET DEFAULT 0;
-ALTER TABLE users ALTER COLUMN score SET NOT NULL;
-```
-
-### Safe Index Creation
-
-```sql
--- UNSAFE: Locks table
-CREATE INDEX idx_orders_user ON orders(user_id);
-
--- SAFE: Non-blocking
-CREATE INDEX CONCURRENTLY idx_orders_user ON orders(user_id);
-
--- Note: CONCURRENTLY cannot run in a transaction
-```
-
-### Safe Column Removal
-
-```sql
--- Step 1: Stop writing to column (application change)
--- Step 2: Wait for all deployments
--- Step 3: Drop column
-ALTER TABLE users DROP COLUMN IF EXISTS legacy_field;
-```
-
----
-
-## 7. Monitoring and Alerting
-
-### Key Metrics to Monitor
-
-```sql
--- Active connections
-SELECT count(*) FROM pg_stat_activity WHERE state = 'active';
-
--- Connection by state
-SELECT state, count(*)
-FROM pg_stat_activity
-GROUP BY state;
-
--- Long-running queries
-SELECT
-  pid,
-  now() - pg_stat_activity.query_start AS duration,
-  query,
-  state
-FROM pg_stat_activity
-WHERE (now() - pg_stat_activity.query_start) > interval '5 minutes'
-  AND state != 'idle';
-
--- Table bloat
-SELECT
-  schemaname,
-  tablename,
-  pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) as total_size,
-  pg_size_pretty(pg_relation_size(schemaname||'.'||tablename)) as table_size,
-  pg_size_pretty(pg_indexes_size(schemaname||'.'||tablename)) as index_size
-FROM pg_tables
-WHERE schemaname = 'public'
-ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC
-LIMIT 10;
-```
-
-### pg_stat_statements for Query Analysis
-
-```sql
--- Enable extension
-CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
-
--- Find slowest queries
-SELECT
-  round(total_exec_time::numeric, 2) as total_time_ms,
-  calls,
-  round(mean_exec_time::numeric, 2) as avg_time_ms,
-  round((100 * total_exec_time / sum(total_exec_time) over())::numeric, 2) as percentage,
-  query
-FROM pg_stat_statements
-ORDER BY total_exec_time DESC
-LIMIT 10;
-
--- Find most frequent queries
-SELECT
-  calls,
-  round(total_exec_time::numeric, 2) as total_time_ms,
-  round(mean_exec_time::numeric, 2) as avg_time_ms,
-  query
-FROM pg_stat_statements
-ORDER BY calls DESC
-LIMIT 10;
-```
-
-### Alert Thresholds
-
-| Metric | Warning | Critical |
-|--------|---------|----------|
-| Connection usage | > 70% | > 90% |
-| Query time P95 | > 500ms | > 2s |
-| Replication lag | > 30s | > 5m |
-| Disk usage | > 70% | > 85% |
-| Cache hit ratio | < 95% | < 90% |
-
----
-
-## Quick Reference: PostgreSQL Commands
-
-```sql
--- Check table sizes
-SELECT pg_size_pretty(pg_total_relation_size('orders'));
-
--- Check index sizes
-SELECT pg_size_pretty(pg_indexes_size('orders'));
-
--- Kill a query
-SELECT pg_cancel_backend(pid);  -- Graceful
-SELECT pg_terminate_backend(pid);  -- Force
-
--- Check locks
-SELECT * FROM pg_locks WHERE granted = false;
-
--- Vacuum analyze (update statistics)
-VACUUM ANALYZE orders;
-
--- Check autovacuum status
-SELECT * FROM pg_stat_user_tables WHERE relname = 'orders';
-```
diff --git a/.agent/skills/senior-backend/scripts/api_load_tester.py b/.agent/skills/senior-backend/scripts/api_load_tester.py
deleted file mode 100644
index afa35aa..0000000
--- a/.agent/skills/senior-backend/scripts/api_load_tester.py
+++ /dev/null
@@ -1,607 +0,0 @@
-#!/usr/bin/env python3
-"""
-API Load Tester
-
-Performs HTTP load testing with configurable concurrency, measuring latency
-percentiles, throughput, and error rates.
-
-Usage:
-    python api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-    python api_load_tester.py https://api.example.com/orders --method POST --body '{"item": 1}'
-    python api_load_tester.py https://api.example.com/v1/users https://api.example.com/v2/users --compare
-"""
-
-import os
-import sys
-import json
-import argparse
-import time
-import statistics
-import threading
-import queue
-from concurrent.futures import ThreadPoolExecutor, as_completed
-from dataclasses import dataclass, field, asdict
-from typing import Dict, List, Optional, Tuple
-from datetime import datetime
-from urllib.request import Request, urlopen
-from urllib.error import URLError, HTTPError
-from urllib.parse import urlparse
-import ssl
-
-
-@dataclass
-class RequestResult:
-    """Result of a single HTTP request."""
-    success: bool
-    status_code: int
-    latency_ms: float
-    error: Optional[str] = None
-    response_size: int = 0
-
-
-@dataclass
-class LoadTestResults:
-    """Aggregated load test results."""
-    target_url: str
-    method: str
-    duration_seconds: float
-    concurrency: int
-    total_requests: int
-    successful_requests: int
-    failed_requests: int
-    requests_per_second: float
-
-    # Latency metrics (milliseconds)
-    latency_min: float
-    latency_max: float
-    latency_avg: float
-    latency_p50: float
-    latency_p90: float
-    latency_p95: float
-    latency_p99: float
-    latency_stddev: float
-
-    # Error breakdown
-    errors_by_type: Dict[str, int] = field(default_factory=dict)
-
-    # Transfer metrics
-    total_bytes_received: int = 0
-    throughput_mbps: float = 0.0
-
-    def success_rate(self) -> float:
-        """Calculate success rate percentage."""
-        if self.total_requests == 0:
-            return 0.0
-        return (self.successful_requests / self.total_requests) * 100
-
-
-def calculate_percentile(data: List[float], percentile: float) -> float:
-    """Calculate percentile from sorted data."""
-    if not data:
-        return 0.0
-    k = (len(data) - 1) * (percentile / 100)
-    f = int(k)
-    c = f + 1 if f + 1 < len(data) else f
-    return data[f] + (data[c] - data[f]) * (k - f)
-
-
-class HTTPClient:
-    """HTTP client with configurable settings."""
-
-    def __init__(self, timeout: float = 30.0, headers: Optional[Dict[str, str]] = None,
-                 verify_ssl: bool = True):
-        self.timeout = timeout
-        self.headers = headers or {}
-        self.verify_ssl = verify_ssl
-
-        # Create SSL context
-        if not verify_ssl:
-            self.ssl_context = ssl.create_default_context()
-            self.ssl_context.check_hostname = False
-            self.ssl_context.verify_mode = ssl.CERT_NONE
-        else:
-            self.ssl_context = None
-
-    def request(self, url: str, method: str = 'GET', body: Optional[bytes] = None) -> RequestResult:
-        """Execute HTTP request and return result."""
-        start_time = time.perf_counter()
-
-        try:
-            request = Request(url, data=body, method=method)
-
-            # Add headers
-            for key, value in self.headers.items():
-                request.add_header(key, value)
-
-            # Add content-type for POST/PUT
-            if body and method in ['POST', 'PUT', 'PATCH']:
-                if 'Content-Type' not in self.headers:
-                    request.add_header('Content-Type', 'application/json')
-
-            # Execute request
-            with urlopen(request, timeout=self.timeout, context=self.ssl_context) as response:
-                response_data = response.read()
-                elapsed = (time.perf_counter() - start_time) * 1000
-
-                return RequestResult(
-                    success=True,
-                    status_code=response.status,
-                    latency_ms=elapsed,
-                    response_size=len(response_data),
-                )
-
-        except HTTPError as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=e.code,
-                latency_ms=elapsed,
-                error=f"HTTP {e.code}: {e.reason}",
-            )
-
-        except URLError as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error=f"Connection error: {str(e.reason)}",
-            )
-
-        except TimeoutError:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error="Connection timeout",
-            )
-
-        except Exception as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error=str(e),
-            )
-
-
-class LoadTester:
-    """HTTP load testing engine."""
-
-    def __init__(self, url: str, method: str = 'GET', body: Optional[str] = None,
-                 headers: Optional[Dict[str, str]] = None, concurrency: int = 10,
-                 duration: float = 10.0, timeout: float = 30.0, verify_ssl: bool = True):
-        self.url = url
-        self.method = method.upper()
-        self.body = body.encode() if body else None
-        self.headers = headers or {}
-        self.concurrency = concurrency
-        self.duration = duration
-        self.timeout = timeout
-        self.verify_ssl = verify_ssl
-
-        self.results: List[RequestResult] = []
-        self.stop_event = threading.Event()
-        self.results_lock = threading.Lock()
-
-    def run(self) -> LoadTestResults:
-        """Execute load test and return results."""
-        print(f"Load Testing: {self.url}")
-        print(f"Method: {self.method}")
-        print(f"Concurrency: {self.concurrency}")
-        print(f"Duration: {self.duration}s")
-        print("-" * 50)
-
-        self.results = []
-        self.stop_event.clear()
-
-        start_time = time.time()
-
-        # Start worker threads
-        with ThreadPoolExecutor(max_workers=self.concurrency) as executor:
-            futures = []
-            for _ in range(self.concurrency):
-                future = executor.submit(self._worker)
-                futures.append(future)
-
-            # Wait for duration
-            time.sleep(self.duration)
-            self.stop_event.set()
-
-            # Wait for workers to finish
-            for future in as_completed(futures):
-                try:
-                    future.result()
-                except Exception as e:
-                    print(f"Worker error: {e}")
-
-        elapsed_time = time.time() - start_time
-
-        return self._aggregate_results(elapsed_time)
-
-    def _worker(self):
-        """Worker thread that continuously sends requests."""
-        client = HTTPClient(
-            timeout=self.timeout,
-            headers=self.headers,
-            verify_ssl=self.verify_ssl,
-        )
-
-        while not self.stop_event.is_set():
-            result = client.request(self.url, self.method, self.body)
-
-            with self.results_lock:
-                self.results.append(result)
-
-    def _aggregate_results(self, elapsed_time: float) -> LoadTestResults:
-        """Aggregate individual results into summary."""
-        if not self.results:
-            return LoadTestResults(
-                target_url=self.url,
-                method=self.method,
-                duration_seconds=elapsed_time,
-                concurrency=self.concurrency,
-                total_requests=0,
-                successful_requests=0,
-                failed_requests=0,
-                requests_per_second=0,
-                latency_min=0,
-                latency_max=0,
-                latency_avg=0,
-                latency_p50=0,
-                latency_p90=0,
-                latency_p95=0,
-                latency_p99=0,
-                latency_stddev=0,
-            )
-
-        # Separate successful and failed
-        successful = [r for r in self.results if r.success]
-        failed = [r for r in self.results if not r.success]
-
-        # Latency calculations (from successful requests)
-        latencies = sorted([r.latency_ms for r in successful]) if successful else [0]
-
-        # Error breakdown
-        errors_by_type: Dict[str, int] = {}
-        for r in failed:
-            error_type = r.error or 'Unknown'
-            errors_by_type[error_type] = errors_by_type.get(error_type, 0) + 1
-
-        # Calculate throughput
-        total_bytes = sum(r.response_size for r in successful)
-        throughput_mbps = (total_bytes * 8) / (elapsed_time * 1_000_000) if elapsed_time > 0 else 0
-
-        return LoadTestResults(
-            target_url=self.url,
-            method=self.method,
-            duration_seconds=elapsed_time,
-            concurrency=self.concurrency,
-            total_requests=len(self.results),
-            successful_requests=len(successful),
-            failed_requests=len(failed),
-            requests_per_second=len(self.results) / elapsed_time if elapsed_time > 0 else 0,
-            latency_min=min(latencies),
-            latency_max=max(latencies),
-            latency_avg=statistics.mean(latencies) if latencies else 0,
-            latency_p50=calculate_percentile(latencies, 50),
-            latency_p90=calculate_percentile(latencies, 90),
-            latency_p95=calculate_percentile(latencies, 95),
-            latency_p99=calculate_percentile(latencies, 99),
-            latency_stddev=statistics.stdev(latencies) if len(latencies) > 1 else 0,
-            errors_by_type=errors_by_type,
-            total_bytes_received=total_bytes,
-            throughput_mbps=throughput_mbps,
-        )
-
-
-def print_results(results: LoadTestResults, verbose: bool = False):
-    """Print formatted load test results."""
-    print("\n" + "=" * 60)
-    print("LOAD TEST RESULTS")
-    print("=" * 60)
-
-    print(f"\nTarget: {results.target_url}")
-    print(f"Method: {results.method}")
-    print(f"Duration: {results.duration_seconds:.1f}s")
-    print(f"Concurrency: {results.concurrency}")
-
-    print(f"\nTHROUGHPUT:")
-    print(f"  Total requests: {results.total_requests:,}")
-    print(f"  Requests/sec: {results.requests_per_second:.1f}")
-    print(f"  Successful: {results.successful_requests:,} ({results.success_rate():.1f}%)")
-    print(f"  Failed: {results.failed_requests:,}")
-
-    print(f"\nLATENCY (ms):")
-    print(f"  Min: {results.latency_min:.1f}")
-    print(f"  Avg: {results.latency_avg:.1f}")
-    print(f"  P50: {results.latency_p50:.1f}")
-    print(f"  P90: {results.latency_p90:.1f}")
-    print(f"  P95: {results.latency_p95:.1f}")
-    print(f"  P99: {results.latency_p99:.1f}")
-    print(f"  Max: {results.latency_max:.1f}")
-    print(f"  StdDev: {results.latency_stddev:.1f}")
-
-    if results.errors_by_type:
-        print(f"\nERRORS:")
-        for error_type, count in sorted(results.errors_by_type.items(), key=lambda x: -x[1]):
-            print(f"  {error_type}: {count}")
-
-    if verbose:
-        print(f"\nTRANSFER:")
-        print(f"  Total bytes: {results.total_bytes_received:,}")
-        print(f"  Throughput: {results.throughput_mbps:.2f} Mbps")
-
-    # Recommendations
-    print(f"\nRECOMMENDATIONS:")
-
-    if results.latency_p99 > 500:
-        print(f"  Warning: P99 latency ({results.latency_p99:.0f}ms) exceeds 500ms")
-        print(f"    Consider: Connection pooling, query optimization, caching")
-
-    if results.latency_p95 > 200:
-        print(f"  Warning: P95 latency ({results.latency_p95:.0f}ms) exceeds 200ms target")
-
-    if results.success_rate() < 99.0:
-        print(f"  Warning: Success rate ({results.success_rate():.1f}%) below 99%")
-        print(f"    Check server capacity and error logs")
-
-    if results.latency_stddev > results.latency_avg:
-        print(f"  Warning: High latency variance (stddev > avg)")
-        print(f"    Indicates inconsistent performance")
-
-    if results.success_rate() >= 99.0 and results.latency_p95 <= 200:
-        print(f"  Performance looks good for this load level")
-
-    print("=" * 60)
-
-
-def compare_results(results1: LoadTestResults, results2: LoadTestResults):
-    """Compare two load test results."""
-    print("\n" + "=" * 60)
-    print("COMPARISON RESULTS")
-    print("=" * 60)
-
-    print(f"\n{'Metric':<25} {'Endpoint 1':<15} {'Endpoint 2':<15} {'Diff':<15}")
-    print("-" * 70)
-
-    # Helper to format diff
-    def diff_str(v1: float, v2: float, lower_better: bool = True) -> str:
-        if v1 == 0:
-            return "N/A"
-        diff_pct = ((v2 - v1) / v1) * 100
-        symbol = "-" if (diff_pct < 0) == lower_better else "+"
-        color_good = diff_pct < 0 if lower_better else diff_pct > 0
-        return f"{symbol}{abs(diff_pct):.1f}%"
-
-    metrics = [
-        ("Requests/sec", results1.requests_per_second, results2.requests_per_second, False),
-        ("Success rate (%)", results1.success_rate(), results2.success_rate(), False),
-        ("Latency Avg (ms)", results1.latency_avg, results2.latency_avg, True),
-        ("Latency P50 (ms)", results1.latency_p50, results2.latency_p50, True),
-        ("Latency P90 (ms)", results1.latency_p90, results2.latency_p90, True),
-        ("Latency P95 (ms)", results1.latency_p95, results2.latency_p95, True),
-        ("Latency P99 (ms)", results1.latency_p99, results2.latency_p99, True),
-    ]
-
-    for name, v1, v2, lower_better in metrics:
-        print(f"{name:<25} {v1:<15.1f} {v2:<15.1f} {diff_str(v1, v2, lower_better):<15}")
-
-    print("-" * 70)
-
-    # Summary
-    print(f"\nEndpoint 1: {results1.target_url}")
-    print(f"Endpoint 2: {results2.target_url}")
-
-    # Determine winner
-    score1, score2 = 0, 0
-
-    if results1.requests_per_second > results2.requests_per_second:
-        score1 += 1
-    else:
-        score2 += 1
-
-    if results1.latency_p95 < results2.latency_p95:
-        score1 += 1
-    else:
-        score2 += 1
-
-    if results1.success_rate() > results2.success_rate():
-        score1 += 1
-    else:
-        score2 += 1
-
-    print(f"\nOverall: {'Endpoint 1' if score1 > score2 else 'Endpoint 2'} performs better")
-
-    print("=" * 60)
-
-
-class APILoadTester:
-    """Main load tester class with CLI integration."""
-
-    def __init__(self, urls: List[str], method: str = 'GET', body: Optional[str] = None,
-                 headers: Optional[Dict[str, str]] = None, concurrency: int = 10,
-                 duration: float = 10.0, timeout: float = 30.0, compare: bool = False,
-                 verbose: bool = False, verify_ssl: bool = True):
-        self.urls = urls
-        self.method = method
-        self.body = body
-        self.headers = headers or {}
-        self.concurrency = concurrency
-        self.duration = duration
-        self.timeout = timeout
-        self.compare = compare
-        self.verbose = verbose
-        self.verify_ssl = verify_ssl
-
-    def run(self) -> Dict:
-        """Execute load test(s) and return results."""
-        results = []
-
-        for url in self.urls:
-            tester = LoadTester(
-                url=url,
-                method=self.method,
-                body=self.body,
-                headers=self.headers,
-                concurrency=self.concurrency,
-                duration=self.duration,
-                timeout=self.timeout,
-                verify_ssl=self.verify_ssl,
-            )
-
-            result = tester.run()
-            results.append(result)
-
-            if not self.compare:
-                print_results(result, self.verbose)
-
-        if self.compare and len(results) >= 2:
-            compare_results(results[0], results[1])
-
-        return {
-            'status': 'success',
-            'results': [asdict(r) for r in results],
-        }
-
-
-def parse_headers(header_args: Optional[List[str]]) -> Dict[str, str]:
-    """Parse header arguments into dictionary."""
-    headers = {}
-    if header_args:
-        for h in header_args:
-            if ':' in h:
-                key, value = h.split(':', 1)
-                headers[key.strip()] = value.strip()
-    return headers
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='HTTP load testing tool',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s https://api.example.com/users --concurrency 50 --duration 30
-  %(prog)s https://api.example.com/orders --method POST --body '{"item": 1}'
-  %(prog)s https://api.example.com/v1 https://api.example.com/v2 --compare
-  %(prog)s https://api.example.com/health --header "Authorization: Bearer token"
-        '''
-    )
-
-    parser.add_argument(
-        'urls',
-        nargs='+',
-        help='URL(s) to test'
-    )
-    parser.add_argument(
-        '--method', '-m',
-        default='GET',
-        choices=['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-        help='HTTP method (default: GET)'
-    )
-    parser.add_argument(
-        '--body', '-b',
-        help='Request body (JSON string)'
-    )
-    parser.add_argument(
-        '--header', '-H',
-        action='append',
-        dest='headers',
-        help='HTTP header (format: "Name: Value")'
-    )
-    parser.add_argument(
-        '--concurrency', '-c',
-        type=int,
-        default=10,
-        help='Number of concurrent requests (default: 10)'
-    )
-    parser.add_argument(
-        '--duration', '-d',
-        type=float,
-        default=10.0,
-        help='Test duration in seconds (default: 10)'
-    )
-    parser.add_argument(
-        '--timeout', '-t',
-        type=float,
-        default=30.0,
-        help='Request timeout in seconds (default: 30)'
-    )
-    parser.add_argument(
-        '--compare',
-        action='store_true',
-        help='Compare two endpoints (requires two URLs)'
-    )
-    parser.add_argument(
-        '--no-verify-ssl',
-        action='store_true',
-        help='Disable SSL certificate verification'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        help='Output file path for results'
-    )
-
-    args = parser.parse_args()
-
-    # Validate
-    if args.compare and len(args.urls) < 2:
-        print("Error: --compare requires two URLs", file=sys.stderr)
-        sys.exit(1)
-
-    # Parse headers
-    headers = parse_headers(args.headers)
-
-    try:
-        tester = APILoadTester(
-            urls=args.urls,
-            method=args.method,
-            body=args.body,
-            headers=headers,
-            concurrency=args.concurrency,
-            duration=args.duration,
-            timeout=args.timeout,
-            compare=args.compare,
-            verbose=args.verbose,
-            verify_ssl=not args.no_verify_ssl,
-        )
-
-        results = tester.run()
-
-        if args.json:
-            output = json.dumps(results, indent=2)
-            if args.output:
-                with open(args.output, 'w') as f:
-                    f.write(output)
-                print(f"\nResults written to: {args.output}")
-            else:
-                print(output)
-        elif args.output:
-            with open(args.output, 'w') as f:
-                json.dump(results, f, indent=2)
-            print(f"\nResults written to: {args.output}")
-
-    except KeyboardInterrupt:
-        print("\nTest interrupted by user")
-        sys.exit(1)
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.agent/skills/senior-backend/scripts/api_scaffolder.py b/.agent/skills/senior-backend/scripts/api_scaffolder.py
deleted file mode 100644
index 2207861..0000000
--- a/.agent/skills/senior-backend/scripts/api_scaffolder.py
+++ /dev/null
@@ -1,645 +0,0 @@
-#!/usr/bin/env python3
-"""
-API Scaffolder
-
-Generates Express.js route handlers, validation middleware, and TypeScript types
-from OpenAPI specifications (YAML/JSON).
-
-Usage:
-    python api_scaffolder.py openapi.yaml --output src/routes/
-    python api_scaffolder.py openapi.json --framework fastify --output src/
-    python api_scaffolder.py spec.yaml --types-only --output src/types/
-"""
-
-import os
-import sys
-import json
-import argparse
-import re
-from pathlib import Path
-from typing import Dict, List, Optional, Any
-from datetime import datetime
-
-
-def load_yaml_as_json(content: str) -> Dict:
-    """Parse YAML content without PyYAML dependency (basic subset)."""
-    lines = content.split('\n')
-    result = {}
-    stack = [(result, -1)]
-    current_key = None
-    in_array = False
-    array_indent = -1
-
-    for line in lines:
-        stripped = line.lstrip()
-        if not stripped or stripped.startswith('#'):
-            continue
-
-        indent = len(line) - len(stripped)
-
-        # Pop stack until we find the right level
-        while len(stack) > 1 and stack[-1][1] >= indent:
-            stack.pop()
-
-        current_obj = stack[-1][0]
-
-        if stripped.startswith('- '):
-            # Array item
-            value = stripped[2:].strip()
-            if isinstance(current_obj, list):
-                if ':' in value:
-                    # Object in array
-                    key, val = value.split(':', 1)
-                    new_obj = {key.strip(): val.strip().strip('"').strip("'")}
-                    current_obj.append(new_obj)
-                    stack.append((new_obj, indent))
-                else:
-                    current_obj.append(value.strip('"').strip("'"))
-        elif ':' in stripped:
-            key, value = stripped.split(':', 1)
-            key = key.strip()
-            value = value.strip()
-
-            if value == '':
-                # Check next line for array or object
-                new_obj = {}
-                current_obj[key] = new_obj
-                stack.append((new_obj, indent))
-            elif value.startswith('[') and value.endswith(']'):
-                # Inline array
-                items = value[1:-1].split(',')
-                current_obj[key] = [i.strip().strip('"').strip("'") for i in items if i.strip()]
-            else:
-                # Simple value
-                value = value.strip('"').strip("'")
-                if value.lower() == 'true':
-                    value = True
-                elif value.lower() == 'false':
-                    value = False
-                elif value.isdigit():
-                    value = int(value)
-                current_obj[key] = value
-
-    return result
-
-
-def load_spec(spec_path: Path) -> Dict:
-    """Load OpenAPI spec from YAML or JSON file."""
-    content = spec_path.read_text()
-
-    if spec_path.suffix in ['.yaml', '.yml']:
-        try:
-            import yaml
-            return yaml.safe_load(content)
-        except ImportError:
-            # Fallback to basic YAML parser
-            return load_yaml_as_json(content)
-    else:
-        return json.loads(content)
-
-
-def openapi_type_to_ts(schema: Dict) -> str:
-    """Convert OpenAPI schema type to TypeScript type."""
-    if not schema:
-        return 'unknown'
-
-    if '$ref' in schema:
-        ref = schema['$ref']
-        return ref.split('/')[-1]
-
-    type_map = {
-        'string': 'string',
-        'integer': 'number',
-        'number': 'number',
-        'boolean': 'boolean',
-        'object': 'Record<string, unknown>',
-        'array': 'unknown[]',
-    }
-
-    schema_type = schema.get('type', 'unknown')
-
-    if schema_type == 'array':
-        items = schema.get('items', {})
-        item_type = openapi_type_to_ts(items)
-        return f'{item_type}[]'
-
-    if schema_type == 'object':
-        properties = schema.get('properties', {})
-        if properties:
-            props = []
-            required = schema.get('required', [])
-            for name, prop in properties.items():
-                ts_type = openapi_type_to_ts(prop)
-                optional = '?' if name not in required else ''
-                props.append(f'  {name}{optional}: {ts_type};')
-            return '{\n' + '\n'.join(props) + '\n}'
-        return 'Record<string, unknown>'
-
-    if 'enum' in schema:
-        values = ' | '.join(f"'{v}'" for v in schema['enum'])
-        return values
-
-    return type_map.get(schema_type, 'unknown')
-
-
-def generate_zod_schema(schema: Dict, name: str) -> str:
-    """Generate Zod validation schema from OpenAPI schema."""
-    if not schema:
-        return f'export const {name}Schema = z.unknown();'
-
-    def schema_to_zod(s: Dict) -> str:
-        if '$ref' in s:
-            ref_name = s['$ref'].split('/')[-1]
-            return f'{ref_name}Schema'
-
-        s_type = s.get('type', 'unknown')
-
-        if s_type == 'string':
-            zod = 'z.string()'
-            if 'minLength' in s:
-                zod += f'.min({s["minLength"]})'
-            if 'maxLength' in s:
-                zod += f'.max({s["maxLength"]})'
-            if 'pattern' in s:
-                zod += f'.regex(/{s["pattern"]}/)'
-            if s.get('format') == 'email':
-                zod += '.email()'
-            if s.get('format') == 'uuid':
-                zod += '.uuid()'
-            if 'enum' in s:
-                values = ', '.join(f"'{v}'" for v in s['enum'])
-                return f'z.enum([{values}])'
-            return zod
-
-        if s_type == 'integer':
-            zod = 'z.number().int()'
-            if 'minimum' in s:
-                zod += f'.min({s["minimum"]})'
-            if 'maximum' in s:
-                zod += f'.max({s["maximum"]})'
-            return zod
-
-        if s_type == 'number':
-            zod = 'z.number()'
-            if 'minimum' in s:
-                zod += f'.min({s["minimum"]})'
-            if 'maximum' in s:
-                zod += f'.max({s["maximum"]})'
-            return zod
-
-        if s_type == 'boolean':
-            return 'z.boolean()'
-
-        if s_type == 'array':
-            items_zod = schema_to_zod(s.get('items', {}))
-            return f'z.array({items_zod})'
-
-        if s_type == 'object':
-            properties = s.get('properties', {})
-            required = s.get('required', [])
-            if not properties:
-                return 'z.record(z.unknown())'
-
-            props = []
-            for prop_name, prop_schema in properties.items():
-                prop_zod = schema_to_zod(prop_schema)
-                if prop_name not in required:
-                    prop_zod += '.optional()'
-                props.append(f'  {prop_name}: {prop_zod},')
-
-            return 'z.object({\n' + '\n'.join(props) + '\n})'
-
-        return 'z.unknown()'
-
-    return f'export const {name}Schema = {schema_to_zod(schema)};'
-
-
-def to_camel_case(s: str) -> str:
-    """Convert string to camelCase."""
-    s = re.sub(r'[^a-zA-Z0-9]', ' ', s)
-    words = s.split()
-    if not words:
-        return s
-    return words[0].lower() + ''.join(w.capitalize() for w in words[1:])
-
-
-def to_pascal_case(s: str) -> str:
-    """Convert string to PascalCase."""
-    s = re.sub(r'[^a-zA-Z0-9]', ' ', s)
-    return ''.join(w.capitalize() for w in s.split())
-
-
-def extract_path_params(path: str) -> List[str]:
-    """Extract path parameters from OpenAPI path."""
-    return re.findall(r'\{(\w+)\}', path)
-
-
-def openapi_path_to_express(path: str) -> str:
-    """Convert OpenAPI path to Express path format."""
-    return re.sub(r'\{(\w+)\}', r':\1', path)
-
-
-class APIScaffolder:
-    """Generate Express.js routes from OpenAPI specification."""
-
-    SUPPORTED_FRAMEWORKS = ['express', 'fastify', 'koa']
-
-    def __init__(self, spec_path: str, output_dir: str, framework: str = 'express',
-                 types_only: bool = False, verbose: bool = False):
-        self.spec_path = Path(spec_path)
-        self.output_dir = Path(output_dir)
-        self.framework = framework
-        self.types_only = types_only
-        self.verbose = verbose
-        self.spec: Dict = {}
-        self.generated_files: List[str] = []
-
-    def run(self) -> Dict:
-        """Execute scaffolding process."""
-        print(f"API Scaffolder - {self.framework.capitalize()}")
-        print(f"Spec: {self.spec_path}")
-        print(f"Output: {self.output_dir}")
-        print("-" * 50)
-
-        self.validate()
-        self.load_spec()
-        self.ensure_output_dir()
-
-        if self.types_only:
-            self.generate_types()
-        else:
-            self.generate_types()
-            self.generate_validators()
-            self.generate_routes()
-            self.generate_index()
-
-        return {
-            'status': 'success',
-            'spec': str(self.spec_path),
-            'output': str(self.output_dir),
-            'framework': self.framework,
-            'generated_files': self.generated_files,
-            'routes_count': len(self.get_operations()),
-            'types_count': len(self.get_schemas()),
-        }
-
-    def validate(self):
-        """Validate inputs."""
-        if not self.spec_path.exists():
-            raise FileNotFoundError(f"Spec file not found: {self.spec_path}")
-
-        if self.framework not in self.SUPPORTED_FRAMEWORKS:
-            raise ValueError(f"Unsupported framework: {self.framework}")
-
-    def load_spec(self):
-        """Load and parse OpenAPI specification."""
-        self.spec = load_spec(self.spec_path)
-
-        if self.verbose:
-            title = self.spec.get('info', {}).get('title', 'Unknown')
-            version = self.spec.get('info', {}).get('version', '0.0.0')
-            print(f"Loaded: {title} v{version}")
-
-    def ensure_output_dir(self):
-        """Create output directory if needed."""
-        self.output_dir.mkdir(parents=True, exist_ok=True)
-
-    def get_schemas(self) -> Dict:
-        """Get component schemas from spec."""
-        return self.spec.get('components', {}).get('schemas', {})
-
-    def get_operations(self) -> List[Dict]:
-        """Extract all operations from spec."""
-        operations = []
-        paths = self.spec.get('paths', {})
-
-        for path, methods in paths.items():
-            if not isinstance(methods, dict):
-                continue
-
-            for method, details in methods.items():
-                if method.lower() not in ['get', 'post', 'put', 'patch', 'delete']:
-                    continue
-
-                if not isinstance(details, dict):
-                    continue
-
-                op_id = details.get('operationId', f'{method}_{path}'.replace('/', '_'))
-
-                operations.append({
-                    'path': path,
-                    'method': method.lower(),
-                    'operation_id': op_id,
-                    'summary': details.get('summary', ''),
-                    'parameters': details.get('parameters', []),
-                    'request_body': details.get('requestBody', {}),
-                    'responses': details.get('responses', {}),
-                    'tags': details.get('tags', ['default']),
-                })
-
-        return operations
-
-    def generate_types(self):
-        """Generate TypeScript type definitions."""
-        schemas = self.get_schemas()
-
-        lines = [
-            '// Auto-generated TypeScript types',
-            f'// Generated from: {self.spec_path.name}',
-            f'// Date: {datetime.now().isoformat()}',
-            '',
-        ]
-
-        for name, schema in schemas.items():
-            ts_type = openapi_type_to_ts(schema)
-            if ts_type.startswith('{'):
-                lines.append(f'export interface {name} {ts_type}')
-            else:
-                lines.append(f'export type {name} = {ts_type};')
-            lines.append('')
-
-        # Generate request/response types from operations
-        for op in self.get_operations():
-            op_name = to_pascal_case(op['operation_id'])
-
-            # Request body type
-            req_body = op.get('request_body', {})
-            if req_body:
-                content = req_body.get('content', {})
-                json_content = content.get('application/json', {})
-                schema = json_content.get('schema', {})
-                if schema and '$ref' not in schema:
-                    ts_type = openapi_type_to_ts(schema)
-                    lines.append(f'export interface {op_name}Request {ts_type}')
-                    lines.append('')
-
-            # Response type (200 response)
-            responses = op.get('responses', {})
-            success_resp = responses.get('200', responses.get('201', {}))
-            if success_resp:
-                content = success_resp.get('content', {})
-                json_content = content.get('application/json', {})
-                schema = json_content.get('schema', {})
-                if schema and '$ref' not in schema:
-                    ts_type = openapi_type_to_ts(schema)
-                    lines.append(f'export interface {op_name}Response {ts_type}')
-                    lines.append('')
-
-        types_file = self.output_dir / 'types.ts'
-        types_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(types_file))
-        print(f"  Generated: {types_file}")
-
-    def generate_validators(self):
-        """Generate Zod validation schemas."""
-        schemas = self.get_schemas()
-
-        lines = [
-            "import { z } from 'zod';",
-            '',
-            '// Auto-generated Zod validation schemas',
-            f'// Generated from: {self.spec_path.name}',
-            '',
-        ]
-
-        for name, schema in schemas.items():
-            zod_schema = generate_zod_schema(schema, name)
-            lines.append(zod_schema)
-            lines.append(f'export type {name} = z.infer<typeof {name}Schema>;')
-            lines.append('')
-
-        # Generate validation middleware
-        lines.extend([
-            '// Validation middleware factory',
-            'import { Request, Response, NextFunction } from "express";',
-            '',
-            'export function validate<T>(schema: z.ZodSchema<T>) {',
-            '  return (req: Request, res: Response, next: NextFunction) => {',
-            '    const result = schema.safeParse(req.body);',
-            '    if (!result.success) {',
-            '      return res.status(400).json({',
-            '        error: {',
-            '          code: "VALIDATION_ERROR",',
-            '          message: "Request validation failed",',
-            '          details: result.error.errors.map(e => ({',
-            '            field: e.path.join("."),',
-            '            message: e.message,',
-            '          })),',
-            '        },',
-            '      });',
-            '    }',
-            '    req.body = result.data;',
-            '    next();',
-            '  };',
-            '}',
-        ])
-
-        validators_file = self.output_dir / 'validators.ts'
-        validators_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(validators_file))
-        print(f"  Generated: {validators_file}")
-
-    def generate_routes(self):
-        """Generate route handlers."""
-        operations = self.get_operations()
-
-        # Group by tag
-        routes_by_tag: Dict[str, List[Dict]] = {}
-        for op in operations:
-            tag = op['tags'][0] if op['tags'] else 'default'
-            if tag not in routes_by_tag:
-                routes_by_tag[tag] = []
-            routes_by_tag[tag].append(op)
-
-        # Generate a route file per tag
-        for tag, ops in routes_by_tag.items():
-            self.generate_route_file(tag, ops)
-
-    def generate_route_file(self, tag: str, operations: List[Dict]):
-        """Generate a single route file."""
-        tag_name = to_camel_case(tag)
-
-        lines = [
-            "import { Router, Request, Response, NextFunction } from 'express';",
-            "import { validate } from './validators';",
-            "import * as schemas from './validators';",
-            '',
-            f'const router = Router();',
-            '',
-        ]
-
-        for op in operations:
-            method = op['method']
-            path = openapi_path_to_express(op['path'])
-            handler_name = to_camel_case(op['operation_id'])
-            summary = op.get('summary', '')
-
-            # Check if has request body
-            req_body = op.get('request_body', {})
-            has_body = bool(req_body.get('content', {}).get('application/json'))
-
-            # Find schema reference
-            schema_ref = None
-            if has_body:
-                content = req_body.get('content', {}).get('application/json', {})
-                schema = content.get('schema', {})
-                if '$ref' in schema:
-                    schema_ref = schema['$ref'].split('/')[-1]
-
-            lines.append(f'/**')
-            if summary:
-                lines.append(f' * {summary}')
-            lines.append(f' * {method.upper()} {op["path"]}')
-            lines.append(f' */')
-
-            middleware = ''
-            if schema_ref:
-                middleware = f'validate(schemas.{schema_ref}Schema), '
-
-            lines.append(f"router.{method}('{path}', {middleware}async (req: Request, res: Response, next: NextFunction) => {{")
-            lines.append('  try {')
-
-            # Extract path params
-            path_params = extract_path_params(op['path'])
-            if path_params:
-                lines.append(f"    const {{ {', '.join(path_params)} }} = req.params;")
-
-            lines.append('')
-            lines.append(f'    // TODO: Implement {handler_name}')
-            lines.append('')
-
-            # Default response based on method
-            if method == 'post':
-                lines.append("    res.status(201).json({ message: 'Created' });")
-            elif method == 'delete':
-                lines.append("    res.status(204).send();")
-            else:
-                lines.append("    res.json({ message: 'OK' });")
-
-            lines.append('  } catch (err) {')
-            lines.append('    next(err);')
-            lines.append('  }')
-            lines.append('});')
-            lines.append('')
-
-        lines.append(f'export default router;')
-
-        route_file = self.output_dir / f'{tag_name}.routes.ts'
-        route_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(route_file))
-        print(f"  Generated: {route_file} ({len(operations)} handlers)")
-
-    def generate_index(self):
-        """Generate index file that combines all routes."""
-        operations = self.get_operations()
-
-        # Get unique tags
-        tags = set()
-        for op in operations:
-            tag = op['tags'][0] if op['tags'] else 'default'
-            tags.add(tag)
-
-        lines = [
-            "import { Router } from 'express';",
-            '',
-        ]
-
-        for tag in sorted(tags):
-            tag_name = to_camel_case(tag)
-            lines.append(f"import {tag_name}Routes from './{tag_name}.routes';")
-
-        lines.extend([
-            '',
-            'const router = Router();',
-            '',
-        ])
-
-        for tag in sorted(tags):
-            tag_name = to_camel_case(tag)
-            # Use tag as base path
-            base_path = '/' + tag.lower().replace(' ', '-')
-            lines.append(f"router.use('{base_path}', {tag_name}Routes);")
-
-        lines.extend([
-            '',
-            'export default router;',
-        ])
-
-        index_file = self.output_dir / 'index.ts'
-        index_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(index_file))
-        print(f"  Generated: {index_file}")
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='Generate Express.js routes from OpenAPI specification',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s openapi.yaml --output src/routes/
-  %(prog)s spec.json --framework fastify --output src/api/
-  %(prog)s openapi.yaml --types-only --output src/types/
-        '''
-    )
-
-    parser.add_argument(
-        'spec',
-        help='Path to OpenAPI specification (YAML or JSON)'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        default='./generated',
-        help='Output directory (default: ./generated)'
-    )
-    parser.add_argument(
-        '--framework', '-f',
-        choices=['express', 'fastify', 'koa'],
-        default='express',
-        help='Target framework (default: express)'
-    )
-    parser.add_argument(
-        '--types-only',
-        action='store_true',
-        help='Generate only TypeScript types'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-
-    args = parser.parse_args()
-
-    try:
-        scaffolder = APIScaffolder(
-            spec_path=args.spec,
-            output_dir=args.output,
-            framework=args.framework,
-            types_only=args.types_only,
-            verbose=args.verbose,
-        )
-
-        results = scaffolder.run()
-
-        print("-" * 50)
-        print(f"Generated {results['routes_count']} route handlers")
-        print(f"Generated {results['types_count']} type definitions")
-        print(f"Output: {results['output']}")
-
-        if args.json:
-            print(json.dumps(results, indent=2))
-
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.agent/skills/senior-backend/scripts/database_migration_tool.py b/.agent/skills/senior-backend/scripts/database_migration_tool.py
deleted file mode 100644
index 9bb0e27..0000000
--- a/.agent/skills/senior-backend/scripts/database_migration_tool.py
+++ /dev/null
@@ -1,858 +0,0 @@
-#!/usr/bin/env python3
-"""
-Database Migration Tool
-
-Analyzes SQL schema files, detects potential issues, suggests indexes,
-and generates migration scripts with rollback support.
-
-Usage:
-    python database_migration_tool.py schema.sql --analyze
-    python database_migration_tool.py old.sql --compare new.sql --output migrations/
-    python database_migration_tool.py schema.sql --suggest-indexes
-"""
-
-import os
-import sys
-import json
-import argparse
-import re
-from pathlib import Path
-from typing import Dict, List, Optional, Set, Tuple
-from datetime import datetime
-from dataclasses import dataclass, field, asdict
-
-
-@dataclass
-class Column:
-    """Database column definition."""
-    name: str
-    data_type: str
-    nullable: bool = True
-    default: Optional[str] = None
-    primary_key: bool = False
-    unique: bool = False
-    references: Optional[str] = None
-
-
-@dataclass
-class Index:
-    """Database index definition."""
-    name: str
-    table: str
-    columns: List[str]
-    unique: bool = False
-    partial: Optional[str] = None
-
-
-@dataclass
-class Table:
-    """Database table definition."""
-    name: str
-    columns: Dict[str, Column] = field(default_factory=dict)
-    indexes: List[Index] = field(default_factory=list)
-    primary_key: List[str] = field(default_factory=list)
-    foreign_keys: List[Dict] = field(default_factory=list)
-
-
-@dataclass
-class Issue:
-    """Schema issue or recommendation."""
-    severity: str  # 'error', 'warning', 'info'
-    category: str  # 'index', 'naming', 'type', 'constraint'
-    table: str
-    message: str
-    suggestion: Optional[str] = None
-
-
-class SQLParser:
-    """Parse SQL DDL statements."""
-
-    # Common patterns
-    CREATE_TABLE_PATTERN = re.compile(
-        r'CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?(\w+)["`]?\s*\((.*?)\)\s*;',
-        re.IGNORECASE | re.DOTALL
-    )
-
-    CREATE_INDEX_PATTERN = re.compile(
-        r'CREATE\s+(UNIQUE\s+)?INDEX\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?(\w+)["`]?\s+'
-        r'ON\s+["`]?(\w+)["`]?\s*\(([^)]+)\)(?:\s+WHERE\s+(.+?))?;',
-        re.IGNORECASE | re.DOTALL
-    )
-
-    COLUMN_PATTERN = re.compile(
-        r'["`]?(\w+)["`]?\s+'  # Column name
-        r'(\w+(?:\s*\([^)]+\))?)'  # Data type
-        r'([^,]*)',  # Constraints
-        re.IGNORECASE
-    )
-
-    FK_PATTERN = re.compile(
-        r'FOREIGN\s+KEY\s*\(["`]?(\w+)["`]?\)\s+'
-        r'REFERENCES\s+["`]?(\w+)["`]?\s*\(["`]?(\w+)["`]?\)',
-        re.IGNORECASE
-    )
-
-    def parse(self, sql: str) -> Dict[str, Table]:
-        """Parse SQL and return table definitions."""
-        tables = {}
-
-        # Parse CREATE TABLE statements
-        for match in self.CREATE_TABLE_PATTERN.finditer(sql):
-            table_name = match.group(1)
-            body = match.group(2)
-            table = self._parse_table_body(table_name, body)
-            tables[table_name] = table
-
-        # Parse CREATE INDEX statements
-        for match in self.CREATE_INDEX_PATTERN.finditer(sql):
-            unique = bool(match.group(1))
-            index_name = match.group(2)
-            table_name = match.group(3)
-            columns = [c.strip().strip('"`') for c in match.group(4).split(',')]
-            where_clause = match.group(5)
-
-            index = Index(
-                name=index_name,
-                table=table_name,
-                columns=columns,
-                unique=unique,
-                partial=where_clause.strip() if where_clause else None
-            )
-
-            if table_name in tables:
-                tables[table_name].indexes.append(index)
-
-        return tables
-
-    def _parse_table_body(self, table_name: str, body: str) -> Table:
-        """Parse table body (columns, constraints)."""
-        table = Table(name=table_name)
-
-        # Split by comma, but respect parentheses
-        parts = self._split_by_comma(body)
-
-        for part in parts:
-            part = part.strip()
-
-            # Skip empty parts
-            if not part:
-                continue
-
-            # Check for PRIMARY KEY constraint
-            if part.upper().startswith('PRIMARY KEY'):
-                pk_match = re.search(r'PRIMARY\s+KEY\s*\(([^)]+)\)', part, re.IGNORECASE)
-                if pk_match:
-                    cols = [c.strip().strip('"`') for c in pk_match.group(1).split(',')]
-                    table.primary_key = cols
-
-            # Check for FOREIGN KEY constraint
-            elif part.upper().startswith('FOREIGN KEY'):
-                fk_match = self.FK_PATTERN.search(part)
-                if fk_match:
-                    table.foreign_keys.append({
-                        'column': fk_match.group(1),
-                        'ref_table': fk_match.group(2),
-                        'ref_column': fk_match.group(3),
-                    })
-
-            # Check for CONSTRAINT
-            elif part.upper().startswith('CONSTRAINT'):
-                # Handle named constraints
-                if 'PRIMARY KEY' in part.upper():
-                    pk_match = re.search(r'PRIMARY\s+KEY\s*\(([^)]+)\)', part, re.IGNORECASE)
-                    if pk_match:
-                        cols = [c.strip().strip('"`') for c in pk_match.group(1).split(',')]
-                        table.primary_key = cols
-                elif 'FOREIGN KEY' in part.upper():
-                    fk_match = self.FK_PATTERN.search(part)
-                    if fk_match:
-                        table.foreign_keys.append({
-                            'column': fk_match.group(1),
-                            'ref_table': fk_match.group(2),
-                            'ref_column': fk_match.group(3),
-                        })
-
-            # Regular column definition
-            else:
-                col_match = self.COLUMN_PATTERN.match(part)
-                if col_match:
-                    col_name = col_match.group(1)
-                    col_type = col_match.group(2)
-                    constraints = col_match.group(3).upper() if col_match.group(3) else ''
-
-                    column = Column(
-                        name=col_name,
-                        data_type=col_type.upper(),
-                        nullable='NOT NULL' not in constraints,
-                        primary_key='PRIMARY KEY' in constraints,
-                        unique='UNIQUE' in constraints,
-                    )
-
-                    # Extract default value
-                    default_match = re.search(r'DEFAULT\s+(\S+)', constraints, re.IGNORECASE)
-                    if default_match:
-                        column.default = default_match.group(1)
-
-                    # Extract references
-                    ref_match = re.search(
-                        r'REFERENCES\s+["`]?(\w+)["`]?\s*\(["`]?(\w+)["`]?\)',
-                        constraints,
-                        re.IGNORECASE
-                    )
-                    if ref_match:
-                        column.references = f"{ref_match.group(1)}({ref_match.group(2)})"
-                        table.foreign_keys.append({
-                            'column': col_name,
-                            'ref_table': ref_match.group(1),
-                            'ref_column': ref_match.group(2),
-                        })
-
-                    if column.primary_key and col_name not in table.primary_key:
-                        table.primary_key.append(col_name)
-
-                    table.columns[col_name] = column
-
-        return table
-
-    def _split_by_comma(self, s: str) -> List[str]:
-        """Split string by comma, respecting parentheses."""
-        parts = []
-        current = []
-        depth = 0
-
-        for char in s:
-            if char == '(':
-                depth += 1
-            elif char == ')':
-                depth -= 1
-            elif char == ',' and depth == 0:
-                parts.append(''.join(current))
-                current = []
-                continue
-            current.append(char)
-
-        if current:
-            parts.append(''.join(current))
-
-        return parts
-
-
-class SchemaAnalyzer:
-    """Analyze database schema for issues and optimizations."""
-
-    # Columns that typically need indexes (foreign keys)
-    FK_COLUMN_PATTERNS = ['_id', 'Id', '_ID']
-
-    # Columns that typically need indexes for filtering
-    FILTER_COLUMN_PATTERNS = ['status', 'state', 'type', 'category', 'active', 'enabled', 'deleted']
-
-    # Columns that typically need indexes for sorting/ordering
-    SORT_COLUMN_PATTERNS = ['created_at', 'updated_at', 'date', 'timestamp', 'order', 'position']
-
-    def __init__(self, tables: Dict[str, Table]):
-        self.tables = tables
-        self.issues: List[Issue] = []
-
-    def analyze(self) -> List[Issue]:
-        """Run all analysis checks."""
-        self.issues = []
-
-        for table_name, table in self.tables.items():
-            self._check_naming_conventions(table)
-            self._check_primary_key(table)
-            self._check_foreign_key_indexes(table)
-            self._check_common_filter_columns(table)
-            self._check_timestamp_columns(table)
-            self._check_data_types(table)
-
-        return self.issues
-
-    def _check_naming_conventions(self, table: Table):
-        """Check table and column naming conventions."""
-        # Table name should be lowercase
-        if table.name != table.name.lower():
-            self.issues.append(Issue(
-                severity='warning',
-                category='naming',
-                table=table.name,
-                message=f"Table name '{table.name}' should be lowercase",
-                suggestion=f"Rename to '{table.name.lower()}'"
-            ))
-
-        # Table name should be plural (basic check)
-        if not table.name.endswith('s') and not table.name.endswith('es'):
-            self.issues.append(Issue(
-                severity='info',
-                category='naming',
-                table=table.name,
-                message=f"Table name '{table.name}' should typically be plural",
-            ))
-
-        for col_name, col in table.columns.items():
-            # Column names should be lowercase with underscores
-            if col_name != col_name.lower():
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='naming',
-                    table=table.name,
-                    message=f"Column '{col_name}' should use snake_case",
-                    suggestion=f"Rename to '{self._to_snake_case(col_name)}'"
-                ))
-
-    def _check_primary_key(self, table: Table):
-        """Check for missing primary key."""
-        if not table.primary_key:
-            self.issues.append(Issue(
-                severity='error',
-                category='constraint',
-                table=table.name,
-                message=f"Table '{table.name}' has no primary key",
-                suggestion="Add a primary key column (e.g., 'id SERIAL PRIMARY KEY')"
-            ))
-
-    def _check_foreign_key_indexes(self, table: Table):
-        """Check that foreign key columns have indexes."""
-        indexed_columns = set()
-        for index in table.indexes:
-            indexed_columns.update(index.columns)
-
-        # Primary key columns are implicitly indexed
-        indexed_columns.update(table.primary_key)
-
-        for fk in table.foreign_keys:
-            fk_col = fk['column']
-            if fk_col not in indexed_columns:
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='index',
-                    table=table.name,
-                    message=f"Foreign key column '{fk_col}' is not indexed",
-                    suggestion=f"CREATE INDEX idx_{table.name}_{fk_col} ON {table.name}({fk_col});"
-                ))
-
-        # Also check columns that look like foreign keys but aren't declared
-        for col_name in table.columns:
-            if any(col_name.endswith(pattern) for pattern in self.FK_COLUMN_PATTERNS):
-                if col_name not in indexed_columns:
-                    # Check if it's actually a declared FK
-                    is_declared_fk = any(fk['column'] == col_name for fk in table.foreign_keys)
-                    if not is_declared_fk:
-                        self.issues.append(Issue(
-                            severity='info',
-                            category='index',
-                            table=table.name,
-                            message=f"Column '{col_name}' looks like a foreign key but has no index",
-                            suggestion=f"CREATE INDEX idx_{table.name}_{col_name} ON {table.name}({col_name});"
-                        ))
-
-    def _check_common_filter_columns(self, table: Table):
-        """Check for indexes on commonly filtered columns."""
-        indexed_columns = set()
-        for index in table.indexes:
-            indexed_columns.update(index.columns)
-        indexed_columns.update(table.primary_key)
-
-        for col_name in table.columns:
-            col_lower = col_name.lower()
-            if any(pattern in col_lower for pattern in self.FILTER_COLUMN_PATTERNS):
-                if col_name not in indexed_columns:
-                    self.issues.append(Issue(
-                        severity='info',
-                        category='index',
-                        table=table.name,
-                        message=f"Column '{col_name}' is commonly used for filtering but has no index",
-                        suggestion=f"CREATE INDEX idx_{table.name}_{col_name} ON {table.name}({col_name});"
-                    ))
-
-    def _check_timestamp_columns(self, table: Table):
-        """Check for indexes on timestamp columns used for sorting."""
-        has_created_at = 'created_at' in table.columns
-        has_updated_at = 'updated_at' in table.columns
-
-        if not has_created_at:
-            self.issues.append(Issue(
-                severity='info',
-                category='convention',
-                table=table.name,
-                message=f"Table '{table.name}' has no 'created_at' column",
-                suggestion="Consider adding: created_at TIMESTAMP DEFAULT NOW()"
-            ))
-
-        if not has_updated_at:
-            self.issues.append(Issue(
-                severity='info',
-                category='convention',
-                table=table.name,
-                message=f"Table '{table.name}' has no 'updated_at' column",
-                suggestion="Consider adding: updated_at TIMESTAMP DEFAULT NOW()"
-            ))
-
-    def _check_data_types(self, table: Table):
-        """Check for potential data type issues."""
-        for col_name, col in table.columns.items():
-            dtype = col.data_type.upper()
-
-            # Check for VARCHAR without length
-            if 'VARCHAR' in dtype and '(' not in dtype:
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='type',
-                    table=table.name,
-                    message=f"Column '{col_name}' uses VARCHAR without length",
-                    suggestion="Specify a maximum length, e.g., VARCHAR(255)"
-                ))
-
-            # Check for FLOAT/DOUBLE for monetary values
-            if 'FLOAT' in dtype or 'DOUBLE' in dtype:
-                if 'price' in col_name.lower() or 'amount' in col_name.lower() or 'total' in col_name.lower():
-                    self.issues.append(Issue(
-                        severity='warning',
-                        category='type',
-                        table=table.name,
-                        message=f"Column '{col_name}' uses floating point for monetary value",
-                        suggestion="Use DECIMAL or NUMERIC for monetary values"
-                    ))
-
-            # Check for TEXT columns that might benefit from length limits
-            if dtype == 'TEXT':
-                if 'email' in col_name.lower() or 'url' in col_name.lower():
-                    self.issues.append(Issue(
-                        severity='info',
-                        category='type',
-                        table=table.name,
-                        message=f"Column '{col_name}' uses TEXT but might benefit from VARCHAR",
-                        suggestion=f"Consider VARCHAR(255) for {col_name}"
-                    ))
-
-    def _to_snake_case(self, name: str) -> str:
-        """Convert name to snake_case."""
-        s1 = re.sub('(.)([A-Z][a-z]+)', r'\1_\2', name)
-        return re.sub('([a-z0-9])([A-Z])', r'\1_\2', s1).lower()
-
-
-class MigrationGenerator:
-    """Generate migration scripts from schema differences."""
-
-    def __init__(self, old_tables: Dict[str, Table], new_tables: Dict[str, Table]):
-        self.old_tables = old_tables
-        self.new_tables = new_tables
-
-    def generate(self) -> Tuple[str, str]:
-        """Generate UP and DOWN migration scripts."""
-        up_statements = []
-        down_statements = []
-
-        # Find new tables
-        for table_name, table in self.new_tables.items():
-            if table_name not in self.old_tables:
-                up_statements.append(self._generate_create_table(table))
-                down_statements.append(f"DROP TABLE IF EXISTS {table_name};")
-
-        # Find removed tables
-        for table_name, table in self.old_tables.items():
-            if table_name not in self.new_tables:
-                up_statements.append(f"DROP TABLE IF EXISTS {table_name};")
-                down_statements.append(self._generate_create_table(table))
-
-        # Find modified tables
-        for table_name in set(self.old_tables.keys()) & set(self.new_tables.keys()):
-            old_table = self.old_tables[table_name]
-            new_table = self.new_tables[table_name]
-            up, down = self._compare_tables(old_table, new_table)
-            up_statements.extend(up)
-            down_statements.extend(down)
-
-        up_sql = '\n\n'.join(up_statements) if up_statements else '-- No changes'
-        down_sql = '\n\n'.join(down_statements) if down_statements else '-- No changes'
-
-        return up_sql, down_sql
-
-    def _generate_create_table(self, table: Table) -> str:
-        """Generate CREATE TABLE statement."""
-        lines = [f"CREATE TABLE {table.name} ("]
-
-        col_defs = []
-        for col_name, col in table.columns.items():
-            col_def = f"  {col_name} {col.data_type}"
-            if not col.nullable:
-                col_def += " NOT NULL"
-            if col.default:
-                col_def += f" DEFAULT {col.default}"
-            if col.primary_key and len(table.primary_key) == 1:
-                col_def += " PRIMARY KEY"
-            if col.unique:
-                col_def += " UNIQUE"
-            col_defs.append(col_def)
-
-        # Add composite primary key
-        if len(table.primary_key) > 1:
-            pk_cols = ', '.join(table.primary_key)
-            col_defs.append(f"  PRIMARY KEY ({pk_cols})")
-
-        # Add foreign keys
-        for fk in table.foreign_keys:
-            col_defs.append(
-                f"  FOREIGN KEY ({fk['column']}) REFERENCES {fk['ref_table']}({fk['ref_column']})"
-            )
-
-        lines.append(',\n'.join(col_defs))
-        lines.append(");")
-
-        return '\n'.join(lines)
-
-    def _compare_tables(self, old: Table, new: Table) -> Tuple[List[str], List[str]]:
-        """Compare two tables and generate ALTER statements."""
-        up = []
-        down = []
-
-        # New columns
-        for col_name, col in new.columns.items():
-            if col_name not in old.columns:
-                up.append(f"ALTER TABLE {new.name} ADD COLUMN {col_name} {col.data_type}"
-                         + (" NOT NULL" if not col.nullable else "")
-                         + (f" DEFAULT {col.default}" if col.default else "") + ";")
-                down.append(f"ALTER TABLE {new.name} DROP COLUMN IF EXISTS {col_name};")
-
-        # Removed columns
-        for col_name, col in old.columns.items():
-            if col_name not in new.columns:
-                up.append(f"ALTER TABLE {old.name} DROP COLUMN IF EXISTS {col_name};")
-                down.append(f"ALTER TABLE {old.name} ADD COLUMN {col_name} {col.data_type}"
-                           + (" NOT NULL" if not col.nullable else "")
-                           + (f" DEFAULT {col.default}" if col.default else "") + ";")
-
-        # Modified columns (type changes)
-        for col_name in set(old.columns.keys()) & set(new.columns.keys()):
-            old_col = old.columns[col_name]
-            new_col = new.columns[col_name]
-
-            if old_col.data_type != new_col.data_type:
-                up.append(f"ALTER TABLE {new.name} ALTER COLUMN {col_name} TYPE {new_col.data_type};")
-                down.append(f"ALTER TABLE {old.name} ALTER COLUMN {col_name} TYPE {old_col.data_type};")
-
-        # New indexes
-        old_index_names = {idx.name for idx in old.indexes}
-        for idx in new.indexes:
-            if idx.name not in old_index_names:
-                unique = "UNIQUE " if idx.unique else ""
-                cols = ', '.join(idx.columns)
-                where = f" WHERE {idx.partial}" if idx.partial else ""
-                up.append(f"CREATE {unique}INDEX CONCURRENTLY {idx.name} ON {idx.table}({cols}){where};")
-                down.append(f"DROP INDEX IF EXISTS {idx.name};")
-
-        # Removed indexes
-        new_index_names = {idx.name for idx in new.indexes}
-        for idx in old.indexes:
-            if idx.name not in new_index_names:
-                unique = "UNIQUE " if idx.unique else ""
-                cols = ', '.join(idx.columns)
-                where = f" WHERE {idx.partial}" if idx.partial else ""
-                up.append(f"DROP INDEX IF EXISTS {idx.name};")
-                down.append(f"CREATE {unique}INDEX {idx.name} ON {idx.table}({cols}){where};")
-
-        return up, down
-
-
-class DatabaseMigrationTool:
-    """Main tool for database migration analysis."""
-
-    def __init__(self, schema_path: str, compare_path: Optional[str] = None,
-                 output_dir: Optional[str] = None, verbose: bool = False):
-        self.schema_path = Path(schema_path)
-        self.compare_path = Path(compare_path) if compare_path else None
-        self.output_dir = Path(output_dir) if output_dir else None
-        self.verbose = verbose
-        self.parser = SQLParser()
-
-    def run(self, mode: str = 'analyze') -> Dict:
-        """Execute the tool in specified mode."""
-        print(f"Database Migration Tool")
-        print(f"Schema: {self.schema_path}")
-        print("-" * 50)
-
-        if not self.schema_path.exists():
-            raise FileNotFoundError(f"Schema file not found: {self.schema_path}")
-
-        schema_sql = self.schema_path.read_text()
-        tables = self.parser.parse(schema_sql)
-
-        if self.verbose:
-            print(f"Parsed {len(tables)} tables")
-
-        if mode == 'analyze':
-            return self._analyze(tables)
-        elif mode == 'compare':
-            return self._compare(tables)
-        elif mode == 'suggest-indexes':
-            return self._suggest_indexes(tables)
-        else:
-            raise ValueError(f"Unknown mode: {mode}")
-
-    def _analyze(self, tables: Dict[str, Table]) -> Dict:
-        """Analyze schema for issues."""
-        analyzer = SchemaAnalyzer(tables)
-        issues = analyzer.analyze()
-
-        # Group by severity
-        errors = [i for i in issues if i.severity == 'error']
-        warnings = [i for i in issues if i.severity == 'warning']
-        infos = [i for i in issues if i.severity == 'info']
-
-        print(f"\nAnalysis Results:")
-        print(f"  Tables: {len(tables)}")
-        print(f"  Errors: {len(errors)}")
-        print(f"  Warnings: {len(warnings)}")
-        print(f"  Suggestions: {len(infos)}")
-
-        if errors:
-            print(f"\nERRORS:")
-            for issue in errors:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    Suggestion: {issue.suggestion}")
-
-        if warnings:
-            print(f"\nWARNINGS:")
-            for issue in warnings:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    Suggestion: {issue.suggestion}")
-
-        if self.verbose and infos:
-            print(f"\nSUGGESTIONS:")
-            for issue in infos:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    {issue.suggestion}")
-
-        return {
-            'status': 'success',
-            'tables_count': len(tables),
-            'issues': {
-                'errors': len(errors),
-                'warnings': len(warnings),
-                'suggestions': len(infos),
-            },
-            'issues_detail': [asdict(i) for i in issues],
-        }
-
-    def _compare(self, old_tables: Dict[str, Table]) -> Dict:
-        """Compare two schemas and generate migration."""
-        if not self.compare_path:
-            raise ValueError("Compare path required for compare mode")
-
-        if not self.compare_path.exists():
-            raise FileNotFoundError(f"Compare file not found: {self.compare_path}")
-
-        new_sql = self.compare_path.read_text()
-        new_tables = self.parser.parse(new_sql)
-
-        generator = MigrationGenerator(old_tables, new_tables)
-        up_sql, down_sql = generator.generate()
-
-        print(f"\nComparing schemas:")
-        print(f"  Old: {self.schema_path}")
-        print(f"  New: {self.compare_path}")
-
-        # Calculate changes
-        added_tables = set(new_tables.keys()) - set(old_tables.keys())
-        removed_tables = set(old_tables.keys()) - set(new_tables.keys())
-
-        print(f"\nChanges detected:")
-        print(f"  Added tables: {len(added_tables)}")
-        print(f"  Removed tables: {len(removed_tables)}")
-
-        if self.output_dir:
-            self.output_dir.mkdir(parents=True, exist_ok=True)
-            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
-
-            up_file = self.output_dir / f"{timestamp}_migration.sql"
-            down_file = self.output_dir / f"{timestamp}_migration_rollback.sql"
-
-            up_file.write_text(f"-- Migration: {self.schema_path} -> {self.compare_path}\n"
-                              f"-- Generated: {datetime.now().isoformat()}\n\n"
-                              f"BEGIN;\n\n{up_sql}\n\nCOMMIT;\n")
-
-            down_file.write_text(f"-- Rollback for migration {timestamp}\n"
-                                f"-- Generated: {datetime.now().isoformat()}\n\n"
-                                f"BEGIN;\n\n{down_sql}\n\nCOMMIT;\n")
-
-            print(f"\nGenerated files:")
-            print(f"  Migration: {up_file}")
-            print(f"  Rollback: {down_file}")
-        else:
-            print(f"\n--- UP MIGRATION ---")
-            print(up_sql)
-            print(f"\n--- DOWN MIGRATION ---")
-            print(down_sql)
-
-        return {
-            'status': 'success',
-            'added_tables': list(added_tables),
-            'removed_tables': list(removed_tables),
-            'up_sql': up_sql,
-            'down_sql': down_sql,
-        }
-
-    def _suggest_indexes(self, tables: Dict[str, Table]) -> Dict:
-        """Generate index suggestions."""
-        suggestions = []
-
-        for table_name, table in tables.items():
-            # Get existing indexed columns
-            indexed = set()
-            for idx in table.indexes:
-                indexed.update(idx.columns)
-            indexed.update(table.primary_key)
-
-            # Suggest indexes for foreign keys
-            for fk in table.foreign_keys:
-                if fk['column'] not in indexed:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': fk['column'],
-                        'reason': 'Foreign key',
-                        'sql': f"CREATE INDEX idx_{table_name}_{fk['column']} ON {table_name}({fk['column']});"
-                    })
-
-            # Suggest indexes for common patterns
-            for col_name in table.columns:
-                if col_name in indexed:
-                    continue
-
-                col_lower = col_name.lower()
-
-                # Foreign key pattern
-                if col_name.endswith('_id') and col_name not in indexed:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Likely foreign key',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name});"
-                    })
-
-                # Status/type columns
-                elif col_lower in ['status', 'state', 'type', 'category']:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Common filter column',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name});"
-                    })
-
-                # Timestamp columns
-                elif col_lower in ['created_at', 'updated_at']:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Common sort column',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name} DESC);"
-                    })
-
-        print(f"\nIndex Suggestions ({len(suggestions)} found):")
-        for s in suggestions:
-            print(f"\n  [{s['table']}.{s['column']}] {s['reason']}")
-            print(f"    {s['sql']}")
-
-        if self.output_dir:
-            self.output_dir.mkdir(parents=True, exist_ok=True)
-            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
-            output_file = self.output_dir / f"{timestamp}_add_indexes.sql"
-
-            lines = [
-                f"-- Suggested indexes",
-                f"-- Generated: {datetime.now().isoformat()}",
-                "",
-            ]
-            for s in suggestions:
-                lines.append(f"-- {s['table']}.{s['column']}: {s['reason']}")
-                lines.append(s['sql'])
-                lines.append("")
-
-            output_file.write_text('\n'.join(lines))
-            print(f"\nWritten to: {output_file}")
-
-        return {
-            'status': 'success',
-            'suggestions_count': len(suggestions),
-            'suggestions': suggestions,
-        }
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='Analyze SQL schemas and generate migrations',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s schema.sql --analyze
-  %(prog)s old.sql --compare new.sql --output migrations/
-  %(prog)s schema.sql --suggest-indexes --output migrations/
-        '''
-    )
-
-    parser.add_argument(
-        'schema',
-        help='Path to SQL schema file'
-    )
-    parser.add_argument(
-        '--analyze',
-        action='store_true',
-        help='Analyze schema for issues and optimizations'
-    )
-    parser.add_argument(
-        '--compare',
-        metavar='FILE',
-        help='Compare with another schema file and generate migration'
-    )
-    parser.add_argument(
-        '--suggest-indexes',
-        action='store_true',
-        help='Generate index suggestions'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        help='Output directory for generated files'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-
-    args = parser.parse_args()
-
-    # Determine mode
-    if args.compare:
-        mode = 'compare'
-    elif args.suggest_indexes:
-        mode = 'suggest-indexes'
-    else:
-        mode = 'analyze'
-
-    try:
-        tool = DatabaseMigrationTool(
-            schema_path=args.schema,
-            compare_path=args.compare,
-            output_dir=args.output,
-            verbose=args.verbose,
-        )
-
-        results = tool.run(mode=mode)
-
-        if args.json:
-            print(json.dumps(results, indent=2))
-
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.agent/skills/spring-boot-engineer/SKILL.md b/.agent/skills/spring-boot-engineer/SKILL.md
deleted file mode 100644
index 9ccba6c..0000000
--- a/.agent/skills/spring-boot-engineer/SKILL.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-name: spring-boot-engineer
-description: Use when building Spring Boot 3.x applications, microservices, or reactive Java applications. Invoke for Spring Data JPA, Spring Security 6, WebFlux, Spring Cloud integration.
-triggers:
-  - Spring Boot
-  - Spring Framework
-  - Spring Cloud
-  - Spring Security
-  - Spring Data JPA
-  - Spring WebFlux
-  - Microservices Java
-  - Java REST API
-  - Reactive Java
-role: specialist
-scope: implementation
-output-format: code
----
-
-# Spring Boot Engineer
-
-Senior Spring Boot engineer with expertise in Spring Boot 3+, cloud-native Java development, and enterprise microservices architecture.
-
-## Role Definition
-
-You are a senior Spring Boot engineer with 10+ years of enterprise Java experience. You specialize in Spring Boot 3.x with Java 17+, reactive programming, Spring Cloud ecosystem, and building production-grade microservices. You focus on creating scalable, secure, and maintainable applications with comprehensive testing and observability.
-
-## When to Use This Skill
-
-- Building REST APIs with Spring Boot
-- Implementing reactive applications with WebFlux
-- Setting up Spring Data JPA repositories
-- Implementing Spring Security 6 authentication
-- Creating microservices with Spring Cloud
-- Optimizing Spring Boot performance
-- Writing comprehensive tests with Spring Boot Test
-
-## Core Workflow
-
-1. **Analyze requirements** - Identify service boundaries, APIs, data models, security needs
-2. **Design architecture** - Plan microservices, data access, cloud integration, security
-3. **Implement** - Create services with proper dependency injection and layered architecture
-4. **Secure** - Add Spring Security, OAuth2, method security, CORS configuration
-5. **Test** - Write unit, integration, and slice tests with high coverage
-6. **Deploy** - Configure for cloud deployment with health checks and observability
-
-## Reference Guide
-
-Load detailed guidance based on context:
-
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| Web Layer | `references/web.md` | Controllers, REST APIs, validation, exception handling |
-| Data Access | `references/data.md` | Spring Data JPA, repositories, transactions, projections |
-| Security | `references/security.md` | Spring Security 6, OAuth2, JWT, method security |
-| Cloud Native | `references/cloud.md` | Spring Cloud, Config, Discovery, Gateway, resilience |
-| Testing | `references/testing.md` | @SpringBootTest, MockMvc, Testcontainers, test slices |
-
-## Constraints
-
-### MUST DO
-- Use Spring Boot 3.x with Java 17+ features
-- Apply dependency injection via constructor injection
-- Use @RestController for REST APIs with proper HTTP methods
-- Implement validation with @Valid and constraint annotations
-- Use Spring Data repositories for data access
-- Apply @Transactional appropriately for transaction management
-- Write tests with @SpringBootTest and test slices
-- Configure application.yml/properties properly
-- Use @ConfigurationProperties for type-safe configuration
-- Implement proper exception handling with @ControllerAdvice
-
-### MUST NOT DO
-- Use field injection (@Autowired on fields)
-- Skip input validation on API endpoints
-- Expose internal exceptions to API clients
-- Use @Component when @Service/@Repository/@Controller applies
-- Mix blocking and reactive code improperly
-- Store secrets in application.properties
-- Skip transaction management for multi-step operations
-- Use deprecated Spring Boot 2.x patterns
-- Hardcode URLs, credentials, or configuration
-
-## Output Templates
-
-When implementing Spring Boot features, provide:
-1. Entity/model classes with JPA annotations
-2. Repository interfaces extending Spring Data
-3. Service layer with business logic
-4. Controller with REST endpoints
-5. DTO classes for API requests/responses
-6. Configuration classes if needed
-7. Test classes with appropriate test slices
-8. Brief explanation of architecture decisions
-
-## Knowledge Reference
-
-Spring Boot 3.x, Spring Framework 6, Spring Data JPA, Spring Security 6, Spring Cloud, Project Reactor (WebFlux), JPA/Hibernate, Bean Validation, RestTemplate/WebClient, Actuator, Micrometer, JUnit 5, Mockito, Testcontainers, Docker, Kubernetes
-
-## Related Skills
-
-- **Java Architect** - Enterprise Java patterns and architecture
-- **Database Optimizer** - JPA optimization and query tuning
-- **Microservices Architect** - Service boundaries and patterns
-- **DevOps Engineer** - Deployment and containerization
diff --git a/.agent/skills/spring-boot-engineer/references/cloud.md b/.agent/skills/spring-boot-engineer/references/cloud.md
deleted file mode 100644
index 7be0b16..0000000
--- a/.agent/skills/spring-boot-engineer/references/cloud.md
+++ /dev/null
@@ -1,498 +0,0 @@
-# Cloud Native - Spring Cloud
-
-## Spring Cloud Config Server
-
-```java
-// Config Server
-@SpringBootApplication
-@EnableConfigServer
-public class ConfigServerApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(ConfigServerApplication.class, args);
-    }
-}
-
-// application.yml
-server:
-  port: 8888
-
-spring:
-  cloud:
-    config:
-      server:
-        git:
-          uri: https://github.com/example/config-repo
-          default-label: main
-          search-paths: '{application}'
-          username: ${GIT_USERNAME}
-          password: ${GIT_PASSWORD}
-        native:
-          search-locations: classpath:/config
-  security:
-    user:
-      name: config-user
-      password: ${CONFIG_PASSWORD}
-
-// Config Client
-@SpringBootApplication
-public class ClientApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(ClientApplication.class, args);
-    }
-}
-
-// application.yml (Config Client)
-spring:
-  application:
-    name: user-service
-  config:
-    import: "configserver:http://localhost:8888"
-  cloud:
-    config:
-      username: config-user
-      password: ${CONFIG_PASSWORD}
-      fail-fast: true
-      retry:
-        max-attempts: 6
-        initial-interval: 1000
-```
-
-## Dynamic Configuration Refresh
-
-```java
-@RestController
-@RefreshScope
-public class ConfigController {
-    @Value("${app.feature.enabled:false}")
-    private boolean featureEnabled;
-
-    @Value("${app.max-connections:100}")
-    private int maxConnections;
-
-    @GetMapping("/config")
-    public Map<String, Object> getConfig() {
-        return Map.of(
-            "featureEnabled", featureEnabled,
-            "maxConnections", maxConnections
-        );
-    }
-}
-
-// Refresh configuration via Actuator endpoint:
-// POST /actuator/refresh
-```
-
-## Service Discovery - Eureka
-
-```java
-// Eureka Server
-@SpringBootApplication
-@EnableEurekaServer
-public class EurekaServerApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(EurekaServerApplication.class, args);
-    }
-}
-
-// application.yml (Eureka Server)
-server:
-  port: 8761
-
-eureka:
-  instance:
-    hostname: localhost
-  client:
-    register-with-eureka: false
-    fetch-registry: false
-    service-url:
-      defaultZone: http://${eureka.instance.hostname}:${server.port}/eureka/
-
-// Eureka Client
-@SpringBootApplication
-@EnableDiscoveryClient
-public class UserServiceApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(UserServiceApplication.class, args);
-    }
-}
-
-// application.yml (Eureka Client)
-spring:
-  application:
-    name: user-service
-
-eureka:
-  client:
-    service-url:
-      defaultZone: http://localhost:8761/eureka/
-    registry-fetch-interval-seconds: 5
-  instance:
-    prefer-ip-address: true
-    lease-renewal-interval-in-seconds: 10
-    lease-expiration-duration-in-seconds: 30
-```
-
-## Spring Cloud Gateway
-
-```java
-@SpringBootApplication
-public class GatewayApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(GatewayApplication.class, args);
-    }
-
-    @Bean
-    public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
-        return builder.routes()
-            .route("user-service", r -> r
-                .path("/api/users/**")
-                .filters(f -> f
-                    .rewritePath("/api/users/(?<segment>.*)", "/users/${segment}")
-                    .addRequestHeader("X-Gateway", "Spring-Cloud-Gateway")
-                    .circuitBreaker(config -> config
-                        .setName("userServiceCircuitBreaker")
-                        .setFallbackUri("forward:/fallback/users")
-                    )
-                    .retry(config -> config
-                        .setRetries(3)
-                        .setStatuses(HttpStatus.SERVICE_UNAVAILABLE)
-                    )
-                )
-                .uri("lb://user-service")
-            )
-            .route("order-service", r -> r
-                .path("/api/orders/**")
-                .filters(f -> f
-                    .rewritePath("/api/orders/(?<segment>.*)", "/orders/${segment}")
-                    .requestRateLimiter(config -> config
-                        .setRateLimiter(redisRateLimiter())
-                        .setKeyResolver(userKeyResolver())
-                    )
-                )
-                .uri("lb://order-service")
-            )
-            .build();
-    }
-
-    @Bean
-    public RedisRateLimiter redisRateLimiter() {
-        return new RedisRateLimiter(10, 20); // replenishRate, burstCapacity
-    }
-
-    @Bean
-    public KeyResolver userKeyResolver() {
-        return exchange -> Mono.just(
-            exchange.getRequest().getHeaders().getFirst("X-User-Id")
-        );
-    }
-}
-
-// application.yml (Gateway)
-spring:
-  cloud:
-    gateway:
-      discovery:
-        locator:
-          enabled: true
-          lower-case-service-id: true
-      default-filters:
-        - DedupeResponseHeader=Access-Control-Allow-Origin
-      globalcors:
-        cors-configurations:
-          '[/**]':
-            allowed-origins: "*"
-            allowed-methods:
-              - GET
-              - POST
-              - PUT
-              - DELETE
-            allowed-headers: "*"
-```
-
-## Circuit Breaker - Resilience4j
-
-```java
-@Service
-@RequiredArgsConstructor
-public class ExternalApiService {
-    private final WebClient webClient;
-
-    @CircuitBreaker(name = "externalApi", fallbackMethod = "getFallbackData")
-    @Retry(name = "externalApi")
-    @RateLimiter(name = "externalApi")
-    public Mono<ExternalData> getData(String id) {
-        return webClient
-            .get()
-            .uri("/data/{id}", id)
-            .retrieve()
-            .bodyToMono(ExternalData.class)
-            .timeout(Duration.ofSeconds(3));
-    }
-
-    private Mono<ExternalData> getFallbackData(String id, Exception e) {
-        log.warn("Fallback triggered for id: {}, error: {}", id, e.getMessage());
-        return Mono.just(new ExternalData(id, "Fallback data", LocalDateTime.now()));
-    }
-}
-
-// application.yml
-resilience4j:
-  circuitbreaker:
-    instances:
-      externalApi:
-        register-health-indicator: true
-        sliding-window-size: 10
-        minimum-number-of-calls: 5
-        permitted-number-of-calls-in-half-open-state: 3
-        automatic-transition-from-open-to-half-open-enabled: true
-        wait-duration-in-open-state: 5s
-        failure-rate-threshold: 50
-        event-consumer-buffer-size: 10
-
-  retry:
-    instances:
-      externalApi:
-        max-attempts: 3
-        wait-duration: 1s
-        enable-exponential-backoff: true
-        exponential-backoff-multiplier: 2
-
-  ratelimiter:
-    instances:
-      externalApi:
-        limit-for-period: 10
-        limit-refresh-period: 1s
-        timeout-duration: 0s
-```
-
-## Distributed Tracing - Micrometer Tracing
-
-```java
-// application.yml
-management:
-  tracing:
-    sampling:
-      probability: 1.0
-  zipkin:
-    tracing:
-      endpoint: http://localhost:9411/api/v2/spans
-
-logging:
-  pattern:
-    level: "%5p [${spring.application.name:},%X{traceId:-},%X{spanId:-}]"
-
-// Custom spans
-@Service
-@RequiredArgsConstructor
-public class OrderService {
-    private final Tracer tracer;
-    private final OrderRepository orderRepository;
-
-    public Order processOrder(OrderRequest request) {
-        Span span = tracer.nextSpan().name("processOrder").start();
-        try (Tracer.SpanInScope ws = tracer.withSpan(span)) {
-            span.tag("order.type", request.type());
-            span.tag("order.items", String.valueOf(request.items().size()));
-
-            // Business logic
-            Order order = createOrder(request);
-
-            span.event("order.created");
-            return order;
-        } finally {
-            span.end();
-        }
-    }
-}
-```
-
-## Load Balancing with Spring Cloud LoadBalancer
-
-```java
-@Configuration
-@LoadBalancerClient(name = "user-service", configuration = UserServiceLoadBalancerConfig.class)
-public class LoadBalancerConfiguration {
-}
-
-@Configuration
-public class UserServiceLoadBalancerConfig {
-
-    @Bean
-    public ReactorLoadBalancer<ServiceInstance> randomLoadBalancer(
-            LoadBalancerClientFactory clientFactory,
-            ObjectProvider<LoadBalancerProperties> properties) {
-        return new RandomLoadBalancer(
-            clientFactory.getLazyProvider("user-service", ServiceInstanceListSupplier.class),
-            "user-service"
-        );
-    }
-}
-
-@Service
-@RequiredArgsConstructor
-public class UserClientService {
-    private final WebClient.Builder webClientBuilder;
-
-    public Mono<User> getUser(Long id) {
-        return webClientBuilder
-            .baseUrl("http://user-service")
-            .build()
-            .get()
-            .uri("/users/{id}", id)
-            .retrieve()
-            .bodyToMono(User.class);
-    }
-}
-```
-
-## Health Checks & Actuator
-
-```java
-@Component
-public class CustomHealthIndicator implements HealthIndicator {
-
-    @Override
-    public Health health() {
-        boolean serviceUp = checkExternalService();
-
-        if (serviceUp) {
-            return Health.up()
-                .withDetail("externalService", "Available")
-                .withDetail("timestamp", LocalDateTime.now())
-                .build();
-        } else {
-            return Health.down()
-                .withDetail("externalService", "Unavailable")
-                .withDetail("error", "Connection timeout")
-                .build();
-        }
-    }
-
-    private boolean checkExternalService() {
-        // Check external dependency
-        return true;
-    }
-}
-
-// application.yml
-management:
-  endpoints:
-    web:
-      exposure:
-        include: health,info,metrics,prometheus
-  endpoint:
-    health:
-      show-details: always
-      probes:
-        enabled: true
-  health:
-    livenessState:
-      enabled: true
-    readinessState:
-      enabled: true
-  metrics:
-    export:
-      prometheus:
-        enabled: true
-    tags:
-      application: ${spring.application.name}
-```
-
-## Kubernetes Deployment
-
-```yaml
-# deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: user-service
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: user-service
-  template:
-    metadata:
-      labels:
-        app: user-service
-    spec:
-      containers:
-      - name: user-service
-        image: user-service:1.0.0
-        ports:
-        - containerPort: 8080
-        env:
-        - name: SPRING_PROFILES_ACTIVE
-          value: "kubernetes"
-        - name: JAVA_OPTS
-          value: "-Xmx512m -Xms256m"
-        livenessProbe:
-          httpGet:
-            path: /actuator/health/liveness
-            port: 8080
-          initialDelaySeconds: 60
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /actuator/health/readiness
-            port: 8080
-          initialDelaySeconds: 30
-          periodSeconds: 5
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "1Gi"
-            cpu: "1000m"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: user-service
-spec:
-  selector:
-    app: user-service
-  ports:
-  - port: 80
-    targetPort: 8080
-  type: ClusterIP
-```
-
-## Docker Configuration
-
-```dockerfile
-# Dockerfile (Multi-stage)
-FROM eclipse-temurin:17-jdk-alpine AS build
-WORKDIR /workspace/app
-
-COPY mvnw .
-COPY .mvn .mvn
-COPY pom.xml .
-COPY src src
-
-RUN ./mvnw install -DskipTests
-RUN mkdir -p target/dependency && (cd target/dependency; jar -xf ../*.jar)
-
-FROM eclipse-temurin:17-jre-alpine
-VOLUME /tmp
-ARG DEPENDENCY=/workspace/app/target/dependency
-COPY --from=build ${DEPENDENCY}/BOOT-INF/lib /app/lib
-COPY --from=build ${DEPENDENCY}/META-INF /app/META-INF
-COPY --from=build ${DEPENDENCY}/BOOT-INF/classes /app
-
-ENTRYPOINT ["java","-cp","app:app/lib/*","com.example.Application"]
-```
-
-## Quick Reference
-
-| Component | Purpose |
-|-----------|---------|
-| **Config Server** | Centralized configuration management |
-| **Eureka** | Service discovery and registration |
-| **Gateway** | API gateway with routing, filtering, load balancing |
-| **Circuit Breaker** | Fault tolerance and fallback patterns |
-| **Load Balancer** | Client-side load balancing |
-| **Tracing** | Distributed tracing across services |
-| **Actuator** | Production-ready monitoring and management |
-| **Kubernetes** | Container orchestration and deployment |
diff --git a/.agent/skills/spring-boot-engineer/references/data.md b/.agent/skills/spring-boot-engineer/references/data.md
deleted file mode 100644
index f7643b2..0000000
--- a/.agent/skills/spring-boot-engineer/references/data.md
+++ /dev/null
@@ -1,381 +0,0 @@
-# Data Access - Spring Data JPA
-
-## JPA Entity Pattern
-
-```java
-@Entity
-@Table(name = "users", indexes = {
-    @Index(name = "idx_email", columnList = "email", unique = true),
-    @Index(name = "idx_username", columnList = "username")
-})
-@EntityListeners(AuditingEntityListener.class)
-@Getter @Setter
-@NoArgsConstructor
-@AllArgsConstructor
-@Builder
-public class User {
-
-    @Id
-    @GeneratedValue(strategy = GenerationType.IDENTITY)
-    private Long id;
-
-    @Column(nullable = false, unique = true, length = 100)
-    private String email;
-
-    @Column(nullable = false, length = 100)
-    private String password;
-
-    @Column(nullable = false, unique = true, length = 50)
-    private String username;
-
-    @Column(nullable = false)
-    @Builder.Default
-    private Boolean active = true;
-
-    @OneToMany(mappedBy = "user", cascade = CascadeType.ALL, orphanRemoval = true)
-    @Builder.Default
-    private List<Address> addresses = new ArrayList<>();
-
-    @ManyToMany
-    @JoinTable(
-        name = "user_roles",
-        joinColumns = @JoinColumn(name = "user_id"),
-        inverseJoinColumns = @JoinColumn(name = "role_id")
-    )
-    @Builder.Default
-    private Set<Role> roles = new HashSet<>();
-
-    @CreatedDate
-    @Column(nullable = false, updatable = false)
-    private LocalDateTime createdAt;
-
-    @LastModifiedDate
-    @Column(nullable = false)
-    private LocalDateTime updatedAt;
-
-    @Version
-    private Long version;
-
-    // Helper methods for bidirectional relationships
-    public void addAddress(Address address) {
-        addresses.add(address);
-        address.setUser(this);
-    }
-
-    public void removeAddress(Address address) {
-        addresses.remove(address);
-        address.setUser(null);
-    }
-}
-```
-
-## Spring Data JPA Repository
-
-```java
-@Repository
-public interface UserRepository extends JpaRepository<User, Long>,
-                                       JpaSpecificationExecutor<User> {
-
-    Optional<User> findByEmail(String email);
-
-    Optional<User> findByUsername(String username);
-
-    boolean existsByEmail(String email);
-
-    boolean existsByUsername(String username);
-
-    @Query("SELECT u FROM User u LEFT JOIN FETCH u.roles WHERE u.email = :email")
-    Optional<User> findByEmailWithRoles(@Param("email") String email);
-
-    @Query("SELECT u FROM User u WHERE u.active = true AND u.createdAt >= :since")
-    List<User> findActiveUsersSince(@Param("since") LocalDateTime since);
-
-    @Modifying
-    @Query("UPDATE User u SET u.active = false WHERE u.lastLoginAt < :threshold")
-    int deactivateInactiveUsers(@Param("threshold") LocalDateTime threshold);
-
-    // Projection for read-only DTOs
-    @Query("SELECT new com.example.dto.UserSummary(u.id, u.username, u.email) " +
-           "FROM User u WHERE u.active = true")
-    List<UserSummary> findAllActiveSummaries();
-}
-```
-
-## Repository with Specifications
-
-```java
-public class UserSpecifications {
-
-    public static Specification<User> hasEmail(String email) {
-        return (root, query, cb) ->
-            email == null ? null : cb.equal(root.get("email"), email);
-    }
-
-    public static Specification<User> isActive() {
-        return (root, query, cb) -> cb.isTrue(root.get("active"));
-    }
-
-    public static Specification<User> createdAfter(LocalDateTime date) {
-        return (root, query, cb) ->
-            date == null ? null : cb.greaterThanOrEqualTo(root.get("createdAt"), date);
-    }
-
-    public static Specification<User> hasRole(String roleName) {
-        return (root, query, cb) -> {
-            Join<User, Role> roles = root.join("roles", JoinType.INNER);
-            return cb.equal(roles.get("name"), roleName);
-        };
-    }
-}
-
-// Usage in service
-@Service
-@RequiredArgsConstructor
-public class UserService {
-    private final UserRepository userRepository;
-
-    public Page<User> searchUsers(UserSearchCriteria criteria, Pageable pageable) {
-        Specification<User> spec = Specification
-            .where(UserSpecifications.hasEmail(criteria.email()))
-            .and(UserSpecifications.isActive())
-            .and(UserSpecifications.createdAfter(criteria.createdAfter()));
-
-        return userRepository.findAll(spec, pageable);
-    }
-}
-```
-
-## Transaction Management
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional(readOnly = true)
-public class OrderService {
-    private final OrderRepository orderRepository;
-    private final PaymentService paymentService;
-    private final InventoryService inventoryService;
-    private final NotificationService notificationService;
-
-    @Transactional
-    public Order createOrder(OrderCreateRequest request) {
-        // All operations in single transaction
-        Order order = Order.builder()
-            .customerId(request.customerId())
-            .status(OrderStatus.PENDING)
-            .build();
-
-        request.items().forEach(item -> {
-            inventoryService.reserveStock(item.productId(), item.quantity());
-            order.addItem(item);
-        });
-
-        order = orderRepository.save(order);
-
-        try {
-            paymentService.processPayment(order);
-            order.setStatus(OrderStatus.PAID);
-        } catch (PaymentException e) {
-            order.setStatus(OrderStatus.PAYMENT_FAILED);
-            throw e; // Transaction will rollback
-        }
-
-        return orderRepository.save(order);
-    }
-
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public void logOrderEvent(Long orderId, String event) {
-        // Separate transaction - will commit even if parent rolls back
-        OrderEvent orderEvent = new OrderEvent(orderId, event);
-        orderEventRepository.save(orderEvent);
-    }
-
-    @Transactional(noRollbackFor = NotificationException.class)
-    public void completeOrder(Long orderId) {
-        Order order = orderRepository.findById(orderId)
-            .orElseThrow(() -> new ResourceNotFoundException("Order not found"));
-
-        order.setStatus(OrderStatus.COMPLETED);
-        orderRepository.save(order);
-
-        // Won't rollback transaction if notification fails
-        try {
-            notificationService.sendCompletionEmail(order);
-        } catch (NotificationException e) {
-            log.error("Failed to send notification for order {}", orderId, e);
-        }
-    }
-}
-```
-
-## Auditing Configuration
-
-```java
-@Configuration
-@EnableJpaAuditing
-public class JpaAuditingConfig {
-
-    @Bean
-    public AuditorAware<String> auditorProvider() {
-        return () -> {
-            Authentication authentication = SecurityContextHolder
-                .getContext()
-                .getAuthentication();
-
-            if (authentication == null || !authentication.isAuthenticated()) {
-                return Optional.of("system");
-            }
-
-            return Optional.of(authentication.getName());
-        };
-    }
-}
-
-@MappedSuperclass
-@EntityListeners(AuditingEntityListener.class)
-@Getter @Setter
-public abstract class AuditableEntity {
-
-    @CreatedDate
-    @Column(nullable = false, updatable = false)
-    private LocalDateTime createdAt;
-
-    @CreatedBy
-    @Column(nullable = false, updatable = false, length = 100)
-    private String createdBy;
-
-    @LastModifiedDate
-    @Column(nullable = false)
-    private LocalDateTime updatedAt;
-
-    @LastModifiedBy
-    @Column(nullable = false, length = 100)
-    private String updatedBy;
-}
-```
-
-## Projections
-
-```java
-// Interface-based projection
-public interface UserSummary {
-    Long getId();
-    String getUsername();
-    String getEmail();
-
-    @Value("#{target.firstName + ' ' + target.lastName}")
-    String getFullName();
-}
-
-// Class-based projection (DTO)
-public record UserSummaryDto(
-    Long id,
-    String username,
-    String email
-) {}
-
-// Usage
-public interface UserRepository extends JpaRepository<User, Long> {
-    List<UserSummary> findAllBy();
-
-    <T> List<T> findAllBy(Class<T> type);
-}
-
-// Service usage
-List<UserSummary> summaries = userRepository.findAllBy();
-List<UserSummaryDto> dtos = userRepository.findAllBy(UserSummaryDto.class);
-```
-
-## Query Optimization
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional(readOnly = true)
-public class UserQueryService {
-    private final UserRepository userRepository;
-    private final EntityManager entityManager;
-
-    // N+1 problem solved with JOIN FETCH
-    @Query("SELECT DISTINCT u FROM User u " +
-           "LEFT JOIN FETCH u.addresses " +
-           "LEFT JOIN FETCH u.roles " +
-           "WHERE u.active = true")
-    List<User> findAllActiveWithAssociations();
-
-    // Batch fetching
-    @BatchSize(size = 25)
-    @OneToMany(mappedBy = "user")
-    private List<Order> orders;
-
-    // EntityGraph for dynamic fetching
-    @EntityGraph(attributePaths = {"addresses", "roles"})
-    List<User> findAllByActiveTrue();
-
-    // Pagination to avoid loading all data
-    public Page<User> findAllUsers(Pageable pageable) {
-        return userRepository.findAll(pageable);
-    }
-
-    // Native query for complex queries
-    @Query(value = """
-        SELECT u.* FROM users u
-        INNER JOIN orders o ON u.id = o.user_id
-        WHERE o.created_at >= :since
-        GROUP BY u.id
-        HAVING COUNT(o.id) >= :minOrders
-        """, nativeQuery = true)
-    List<User> findFrequentBuyers(@Param("since") LocalDateTime since,
-                                  @Param("minOrders") int minOrders);
-}
-```
-
-## Database Migrations (Flyway)
-
-```sql
--- V1__create_users_table.sql
-CREATE TABLE users (
-    id BIGSERIAL PRIMARY KEY,
-    email VARCHAR(100) NOT NULL UNIQUE,
-    password VARCHAR(100) NOT NULL,
-    username VARCHAR(50) NOT NULL UNIQUE,
-    active BOOLEAN NOT NULL DEFAULT true,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version BIGINT NOT NULL DEFAULT 0
-);
-
-CREATE INDEX idx_users_email ON users(email);
-CREATE INDEX idx_users_username ON users(username);
-CREATE INDEX idx_users_active ON users(active);
-
--- V2__create_addresses_table.sql
-CREATE TABLE addresses (
-    id BIGSERIAL PRIMARY KEY,
-    user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    street VARCHAR(200) NOT NULL,
-    city VARCHAR(100) NOT NULL,
-    country VARCHAR(2) NOT NULL,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX idx_addresses_user_id ON addresses(user_id);
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@Entity` | Marks class as JPA entity |
-| `@Table` | Specifies table details and indexes |
-| `@Id` | Marks primary key field |
-| `@GeneratedValue` | Auto-generated primary key strategy |
-| `@Column` | Column constraints and mapping |
-| `@OneToMany/@ManyToOne` | One-to-many/many-to-one relationships |
-| `@ManyToMany` | Many-to-many relationships |
-| `@JoinColumn/@JoinTable` | Join column/table configuration |
-| `@Transactional` | Declares transaction boundaries |
-| `@Query` | Custom JPQL/native queries |
-| `@Modifying` | Marks query as UPDATE/DELETE |
-| `@EntityGraph` | Defines fetch graph for associations |
-| `@Version` | Optimistic locking version field |
diff --git a/.agent/skills/spring-boot-engineer/references/security.md b/.agent/skills/spring-boot-engineer/references/security.md
deleted file mode 100644
index 9a4bfa3..0000000
--- a/.agent/skills/spring-boot-engineer/references/security.md
+++ /dev/null
@@ -1,459 +0,0 @@
-# Security - Spring Security 6
-
-## Security Configuration
-
-```java
-@Configuration
-@EnableWebSecurity
-@EnableMethodSecurity
-public class SecurityConfig {
-
-    @Bean
-    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-        http
-            .csrf(csrf -> csrf
-                .ignoringRequestMatchers("/api/auth/**")
-                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
-            )
-            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
-            .authorizeHttpRequests(auth -> auth
-                .requestMatchers("/api/auth/**", "/actuator/health").permitAll()
-                .requestMatchers("/api/admin/**").hasRole("ADMIN")
-                .requestMatchers("/api/users/**").hasAnyRole("USER", "ADMIN")
-                .anyRequest().authenticated()
-            )
-            .sessionManagement(session -> session
-                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-            )
-            .exceptionHandling(ex -> ex
-                .authenticationEntryPoint(authenticationEntryPoint())
-                .accessDeniedHandler(accessDeniedHandler())
-            )
-            .addFilterBefore(jwtAuthenticationFilter(),
-                           UsernamePasswordAuthenticationFilter.class);
-
-        return http.build();
-    }
-
-    @Bean
-    public CorsConfigurationSource corsConfigurationSource() {
-        CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
-        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
-        configuration.setAllowedHeaders(List.of("*"));
-        configuration.setAllowCredentials(true);
-        configuration.setMaxAge(3600L);
-
-        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        source.registerCorsConfiguration("/**", configuration);
-        return source;
-    }
-
-    @Bean
-    public AuthenticationManager authenticationManager(
-            AuthenticationConfiguration config) throws Exception {
-        return config.getAuthenticationManager();
-    }
-
-    @Bean
-    public PasswordEncoder passwordEncoder() {
-        return new BCryptPasswordEncoder(12);
-    }
-}
-```
-
-## JWT Authentication Filter
-
-```java
-@Component
-@RequiredArgsConstructor
-public class JwtAuthenticationFilter extends OncePerRequestFilter {
-    private final JwtService jwtService;
-    private final UserDetailsService userDetailsService;
-
-    @Override
-    protected void doFilterInternal(
-            @NonNull HttpServletRequest request,
-            @NonNull HttpServletRequest response,
-            @NonNull FilterChain filterChain) throws ServletException, IOException {
-
-        final String authHeader = request.getHeader("Authorization");
-        final String jwt;
-        final String username;
-
-        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
-            filterChain.doFilter(request, response);
-            return;
-        }
-
-        jwt = authHeader.substring(7);
-
-        try {
-            username = jwtService.extractUsername(jwt);
-
-            if (username != null && SecurityContextHolder.getContext()
-                    .getAuthentication() == null) {
-                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
-
-                if (jwtService.isTokenValid(jwt, userDetails)) {
-                    UsernamePasswordAuthenticationToken authToken =
-                        new UsernamePasswordAuthenticationToken(
-                            userDetails,
-                            null,
-                            userDetails.getAuthorities()
-                        );
-
-                    authToken.setDetails(
-                        new WebAuthenticationDetailsSource().buildDetails(request)
-                    );
-
-                    SecurityContextHolder.getContext().setAuthentication(authToken);
-                }
-            }
-        } catch (JwtException e) {
-            log.error("JWT validation failed", e);
-        }
-
-        filterChain.doFilter(request, response);
-    }
-}
-```
-
-## JWT Service
-
-```java
-@Service
-public class JwtService {
-    @Value("${jwt.secret}")
-    private String secretKey;
-
-    @Value("${jwt.expiration}")
-    private long jwtExpiration;
-
-    @Value("${jwt.refresh-expiration}")
-    private long refreshExpiration;
-
-    public String extractUsername(String token) {
-        return extractClaim(token, Claims::getSubject);
-    }
-
-    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
-        final Claims claims = extractAllClaims(token);
-        return claimsResolver.apply(claims);
-    }
-
-    public String generateToken(UserDetails userDetails) {
-        Map<String, Object> extraClaims = new HashMap<>();
-        extraClaims.put("roles", userDetails.getAuthorities().stream()
-            .map(GrantedAuthority::getAuthority)
-            .collect(Collectors.toList()));
-
-        return generateToken(extraClaims, userDetails);
-    }
-
-    public String generateToken(
-            Map<String, Object> extraClaims,
-            UserDetails userDetails) {
-        return buildToken(extraClaims, userDetails, jwtExpiration);
-    }
-
-    public String generateRefreshToken(UserDetails userDetails) {
-        return buildToken(new HashMap<>(), userDetails, refreshExpiration);
-    }
-
-    private String buildToken(
-            Map<String, Object> extraClaims,
-            UserDetails userDetails,
-            long expiration) {
-        return Jwts
-            .builder()
-            .setClaims(extraClaims)
-            .setSubject(userDetails.getUsername())
-            .setIssuedAt(new Date(System.currentTimeMillis()))
-            .setExpiration(new Date(System.currentTimeMillis() + expiration))
-            .signWith(getSignInKey(), SignatureAlgorithm.HS256)
-            .compact();
-    }
-
-    public boolean isTokenValid(String token, UserDetails userDetails) {
-        final String username = extractUsername(token);
-        return username.equals(userDetails.getUsername()) && !isTokenExpired(token);
-    }
-
-    private boolean isTokenExpired(String token) {
-        return extractExpiration(token).before(new Date());
-    }
-
-    private Date extractExpiration(String token) {
-        return extractClaim(token, Claims::getExpiration);
-    }
-
-    private Claims extractAllClaims(String token) {
-        return Jwts
-            .parserBuilder()
-            .setSigningKey(getSignInKey())
-            .build()
-            .parseClaimsJws(token)
-            .getBody();
-    }
-
-    private Key getSignInKey() {
-        byte[] keyBytes = Decoders.BASE64.decode(secretKey);
-        return Keys.hmacShaKeyFor(keyBytes);
-    }
-}
-```
-
-## UserDetailsService Implementation
-
-```java
-@Service
-@RequiredArgsConstructor
-public class CustomUserDetailsService implements UserDetailsService {
-    private final UserRepository userRepository;
-
-    @Override
-    @Transactional(readOnly = true)
-    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
-        User user = userRepository.findByEmailWithRoles(username)
-            .orElseThrow(() -> new UsernameNotFoundException(
-                "User not found with email: " + username));
-
-        return org.springframework.security.core.userdetails.User
-            .builder()
-            .username(user.getEmail())
-            .password(user.getPassword())
-            .authorities(user.getRoles().stream()
-                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
-                .collect(Collectors.toList()))
-            .accountExpired(false)
-            .accountLocked(!user.getActive())
-            .credentialsExpired(false)
-            .disabled(!user.getActive())
-            .build();
-    }
-}
-```
-
-## Authentication Controller
-
-```java
-@RestController
-@RequestMapping("/api/auth")
-@RequiredArgsConstructor
-public class AuthenticationController {
-    private final AuthenticationService authenticationService;
-
-    @PostMapping("/register")
-    public ResponseEntity<AuthenticationResponse> register(
-            @Valid @RequestBody RegisterRequest request) {
-        AuthenticationResponse response = authenticationService.register(request);
-        return ResponseEntity.status(HttpStatus.CREATED).body(response);
-    }
-
-    @PostMapping("/login")
-    public ResponseEntity<AuthenticationResponse> login(
-            @Valid @RequestBody LoginRequest request) {
-        AuthenticationResponse response = authenticationService.login(request);
-        return ResponseEntity.ok(response);
-    }
-
-    @PostMapping("/refresh")
-    public ResponseEntity<AuthenticationResponse> refreshToken(
-            @RequestBody RefreshTokenRequest request) {
-        AuthenticationResponse response = authenticationService.refreshToken(request);
-        return ResponseEntity.ok(response);
-    }
-
-    @PostMapping("/logout")
-    @PreAuthorize("isAuthenticated()")
-    public ResponseEntity<Void> logout() {
-        SecurityContextHolder.clearContext();
-        return ResponseEntity.noContent().build();
-    }
-}
-```
-
-## Authentication Service
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional
-public class AuthenticationService {
-    private final UserRepository userRepository;
-    private final PasswordEncoder passwordEncoder;
-    private final JwtService jwtService;
-    private final AuthenticationManager authenticationManager;
-
-    public AuthenticationResponse register(RegisterRequest request) {
-        if (userRepository.existsByEmail(request.email())) {
-            throw new DuplicateResourceException("Email already registered");
-        }
-
-        User user = User.builder()
-            .email(request.email())
-            .password(passwordEncoder.encode(request.password()))
-            .username(request.username())
-            .active(true)
-            .roles(Set.of(Role.builder().name("USER").build()))
-            .build();
-
-        user = userRepository.save(user);
-
-        String accessToken = jwtService.generateToken(convertToUserDetails(user));
-        String refreshToken = jwtService.generateRefreshToken(convertToUserDetails(user));
-
-        return new AuthenticationResponse(accessToken, refreshToken);
-    }
-
-    public AuthenticationResponse login(LoginRequest request) {
-        authenticationManager.authenticate(
-            new UsernamePasswordAuthenticationToken(
-                request.email(),
-                request.password()
-            )
-        );
-
-        User user = userRepository.findByEmail(request.email())
-            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
-
-        String accessToken = jwtService.generateToken(convertToUserDetails(user));
-        String refreshToken = jwtService.generateRefreshToken(convertToUserDetails(user));
-
-        return new AuthenticationResponse(accessToken, refreshToken);
-    }
-
-    public AuthenticationResponse refreshToken(RefreshTokenRequest request) {
-        String username = jwtService.extractUsername(request.refreshToken());
-
-        User user = userRepository.findByEmail(username)
-            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
-
-        UserDetails userDetails = convertToUserDetails(user);
-
-        if (!jwtService.isTokenValid(request.refreshToken(), userDetails)) {
-            throw new InvalidTokenException("Invalid refresh token");
-        }
-
-        String accessToken = jwtService.generateToken(userDetails);
-
-        return new AuthenticationResponse(accessToken, request.refreshToken());
-    }
-
-    private UserDetails convertToUserDetails(User user) {
-        return org.springframework.security.core.userdetails.User
-            .builder()
-            .username(user.getEmail())
-            .password(user.getPassword())
-            .authorities(user.getRoles().stream()
-                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
-                .collect(Collectors.toList()))
-            .build();
-    }
-}
-```
-
-## Method Security
-
-```java
-@Service
-@RequiredArgsConstructor
-public class UserService {
-    private final UserRepository userRepository;
-
-    @PreAuthorize("hasRole('ADMIN')")
-    public List<User> getAllUsers() {
-        return userRepository.findAll();
-    }
-
-    @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
-    public User getUserById(Long userId) {
-        return userRepository.findById(userId)
-            .orElseThrow(() -> new ResourceNotFoundException("User not found"));
-    }
-
-    @PreAuthorize("isAuthenticated()")
-    @PostAuthorize("returnObject.email == authentication.principal.username")
-    public User updateProfile(Long userId, UserUpdateRequest request) {
-        User user = getUserById(userId);
-        // Update logic
-        return userRepository.save(user);
-    }
-
-    @Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
-    public void deleteUser(Long userId) {
-        userRepository.deleteById(userId);
-    }
-}
-```
-
-## OAuth2 Resource Server (JWT)
-
-```java
-@Configuration
-@EnableWebSecurity
-public class OAuth2ResourceServerConfig {
-
-    @Bean
-    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-        http
-            .authorizeHttpRequests(auth -> auth
-                .requestMatchers("/public/**").permitAll()
-                .anyRequest().authenticated()
-            )
-            .oauth2ResourceServer(oauth2 -> oauth2
-                .jwt(jwt -> jwt
-                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
-                )
-            );
-
-        return http.build();
-    }
-
-    @Bean
-    public JwtDecoder jwtDecoder() {
-        return JwtDecoders.fromIssuerLocation("https://auth.example.com");
-    }
-
-    @Bean
-    public JwtAuthenticationConverter jwtAuthenticationConverter() {
-        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter =
-            new JwtGrantedAuthoritiesConverter();
-        grantedAuthoritiesConverter.setAuthoritiesClaimName("roles");
-        grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
-
-        JwtAuthenticationConverter jwtAuthenticationConverter =
-            new JwtAuthenticationConverter();
-        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(
-            grantedAuthoritiesConverter);
-
-        return jwtAuthenticationConverter;
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@EnableWebSecurity` | Enables Spring Security |
-| `@EnableMethodSecurity` | Enables method-level security annotations |
-| `@PreAuthorize` | Checks authorization before method execution |
-| `@PostAuthorize` | Checks authorization after method execution |
-| `@Secured` | Role-based method security |
-| `@WithMockUser` | Mock authenticated user in tests |
-| `@AuthenticationPrincipal` | Inject current user in controller |
-
-## Security Best Practices
-
-- Always use HTTPS in production
-- Store JWT secret in environment variables
-- Use strong password encoding (BCrypt with strength 12+)
-- Implement token refresh mechanism
-- Add rate limiting to authentication endpoints
-- Validate all user inputs
-- Log security events
-- Keep dependencies updated
-- Use CSRF protection for state-changing operations
-- Implement proper session timeout
diff --git a/.agent/skills/spring-boot-engineer/references/testing.md b/.agent/skills/spring-boot-engineer/references/testing.md
deleted file mode 100644
index 9bfec1d..0000000
--- a/.agent/skills/spring-boot-engineer/references/testing.md
+++ /dev/null
@@ -1,545 +0,0 @@
-# Testing - Spring Boot Test
-
-## Unit Testing with JUnit 5
-
-```java
-@ExtendWith(MockitoExtension.class)
-class UserServiceTest {
-
-    @Mock
-    private UserRepository userRepository;
-
-    @Mock
-    private PasswordEncoder passwordEncoder;
-
-    @InjectMocks
-    private UserService userService;
-
-    @Test
-    @DisplayName("Should create user successfully")
-    void shouldCreateUser() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        User user = User.builder()
-            .id(1L)
-            .email(request.email())
-            .username(request.username())
-            .build();
-
-        when(userRepository.existsByEmail(request.email())).thenReturn(false);
-        when(passwordEncoder.encode(request.password())).thenReturn("encodedPassword");
-        when(userRepository.save(any(User.class))).thenReturn(user);
-
-        // When
-        UserResponse response = userService.create(request);
-
-        // Then
-        assertThat(response).isNotNull();
-        assertThat(response.email()).isEqualTo(request.email());
-
-        verify(userRepository).existsByEmail(request.email());
-        verify(passwordEncoder).encode(request.password());
-        verify(userRepository).save(any(User.class));
-    }
-
-    @Test
-    @DisplayName("Should throw exception when email already exists")
-    void shouldThrowExceptionWhenEmailExists() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        when(userRepository.existsByEmail(request.email())).thenReturn(true);
-
-        // When & Then
-        assertThatThrownBy(() -> userService.create(request))
-            .isInstanceOf(DuplicateResourceException.class)
-            .hasMessageContaining("Email already registered");
-
-        verify(userRepository, never()).save(any(User.class));
-    }
-}
-```
-
-## Integration Testing with @SpringBootTest
-
-```java
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
-class UserIntegrationTest {
-
-    @Autowired
-    private TestRestTemplate restTemplate;
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @BeforeEach
-    void setUp() {
-        userRepository.deleteAll();
-    }
-
-    @Test
-    @Order(1)
-    @DisplayName("Should create user via API")
-    void shouldCreateUserViaApi() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        // When
-        ResponseEntity<UserResponse> response = restTemplate.postForEntity(
-            "/api/v1/users",
-            request,
-            UserResponse.class
-        );
-
-        // Then
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.CREATED);
-        assertThat(response.getBody()).isNotNull();
-        assertThat(response.getBody().email()).isEqualTo(request.email());
-        assertThat(response.getHeaders().getLocation()).isNotNull();
-    }
-
-    @Test
-    @Order(2)
-    @DisplayName("Should return validation error for invalid request")
-    void shouldReturnValidationError() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "invalid-email",
-            "short",
-            "u",
-            15
-        );
-
-        // When
-        ResponseEntity<ValidationErrorResponse> response = restTemplate.postForEntity(
-            "/api/v1/users",
-            request,
-            ValidationErrorResponse.class
-        );
-
-        // Then
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
-        assertThat(response.getBody()).isNotNull();
-        assertThat(response.getBody().errors()).isNotEmpty();
-    }
-}
-```
-
-## Web Layer Testing with MockMvc
-
-```java
-@WebMvcTest(UserController.class)
-@Import(SecurityConfig.class)
-class UserControllerTest {
-
-    @Autowired
-    private MockMvc mockMvc;
-
-    @MockBean
-    private UserService userService;
-
-    @Autowired
-    private ObjectMapper objectMapper;
-
-    @Test
-    @WithMockUser(roles = "ADMIN")
-    @DisplayName("Should get all users")
-    void shouldGetAllUsers() throws Exception {
-        // Given
-        Page<UserResponse> users = new PageImpl<>(List.of(
-            new UserResponse(1L, "user1@example.com", "user1", 25, true, null, null),
-            new UserResponse(2L, "user2@example.com", "user2", 30, true, null, null)
-        ));
-
-        when(userService.findAll(any(Pageable.class))).thenReturn(users);
-
-        // When & Then
-        mockMvc.perform(get("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.content").isArray())
-            .andExpect(jsonPath("$.content.length()").value(2))
-            .andExpect(jsonPath("$.content[0].email").value("user1@example.com"))
-            .andDo(print());
-    }
-
-    @Test
-    @WithMockUser(roles = "ADMIN")
-    @DisplayName("Should create user")
-    void shouldCreateUser() throws Exception {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        UserResponse response = new UserResponse(
-            1L,
-            request.email(),
-            request.username(),
-            request.age(),
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.create(any(UserCreateRequest.class))).thenReturn(response);
-
-        // When & Then
-        mockMvc.perform(post("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON)
-                .content(objectMapper.writeValueAsString(request)))
-            .andExpect(status().isCreated())
-            .andExpect(header().exists("Location"))
-            .andExpect(jsonPath("$.email").value(request.email()))
-            .andExpect(jsonPath("$.username").value(request.username()))
-            .andDo(print());
-    }
-
-    @Test
-    @WithMockUser(roles = "USER")
-    @DisplayName("Should return 403 for non-admin user")
-    void shouldReturn403ForNonAdmin() throws Exception {
-        mockMvc.perform(get("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON))
-            .andExpect(status().isForbidden());
-    }
-}
-```
-
-## Data JPA Testing
-
-```java
-@DataJpaTest
-@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
-@ActiveProfiles("test")
-class UserRepositoryTest {
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @Autowired
-    private TestEntityManager entityManager;
-
-    @Test
-    @DisplayName("Should find user by email")
-    void shouldFindUserByEmail() {
-        // Given
-        User user = User.builder()
-            .email("test@example.com")
-            .password("password")
-            .username("testuser")
-            .active(true)
-            .build();
-
-        entityManager.persistAndFlush(user);
-
-        // When
-        Optional<User> found = userRepository.findByEmail("test@example.com");
-
-        // Then
-        assertThat(found).isPresent();
-        assertThat(found.get().getEmail()).isEqualTo("test@example.com");
-    }
-
-    @Test
-    @DisplayName("Should check if email exists")
-    void shouldCheckIfEmailExists() {
-        // Given
-        User user = User.builder()
-            .email("test@example.com")
-            .password("password")
-            .username("testuser")
-            .active(true)
-            .build();
-
-        entityManager.persistAndFlush(user);
-
-        // When
-        boolean exists = userRepository.existsByEmail("test@example.com");
-
-        // Then
-        assertThat(exists).isTrue();
-    }
-
-    @Test
-    @DisplayName("Should fetch user with roles")
-    void shouldFetchUserWithRoles() {
-        // Given
-        Role adminRole = Role.builder().name("ADMIN").build();
-        entityManager.persist(adminRole);
-
-        User user = User.builder()
-            .email("admin@example.com")
-            .password("password")
-            .username("admin")
-            .active(true)
-            .roles(Set.of(adminRole))
-            .build();
-
-        entityManager.persistAndFlush(user);
-        entityManager.clear();
-
-        // When
-        Optional<User> found = userRepository.findByEmailWithRoles("admin@example.com");
-
-        // Then
-        assertThat(found).isPresent();
-        assertThat(found.get().getRoles()).hasSize(1);
-        assertThat(found.get().getRoles()).extracting(Role::getName).contains("ADMIN");
-    }
-}
-```
-
-## Testcontainers for Database
-
-```java
-@SpringBootTest
-@Testcontainers
-@ActiveProfiles("test")
-class UserServiceIntegrationTest {
-
-    @Container
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:15-alpine")
-        .withDatabaseName("testdb")
-        .withUsername("test")
-        .withPassword("test");
-
-    @DynamicPropertySource
-    static void configureProperties(DynamicPropertyRegistry registry) {
-        registry.add("spring.datasource.url", postgres::getJdbcUrl);
-        registry.add("spring.datasource.username", postgres::getUsername);
-        registry.add("spring.datasource.password", postgres::getPassword);
-    }
-
-    @Autowired
-    private UserService userService;
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @BeforeEach
-    void setUp() {
-        userRepository.deleteAll();
-    }
-
-    @Test
-    @DisplayName("Should create and find user in real database")
-    void shouldCreateAndFindUser() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        // When
-        UserResponse created = userService.create(request);
-        UserResponse found = userService.findById(created.id());
-
-        // Then
-        assertThat(found).isNotNull();
-        assertThat(found.email()).isEqualTo(request.email());
-    }
-}
-```
-
-## Testing Reactive Endpoints with WebTestClient
-
-```java
-@WebFluxTest(UserReactiveController.class)
-class UserReactiveControllerTest {
-
-    @Autowired
-    private WebTestClient webTestClient;
-
-    @MockBean
-    private UserReactiveService userService;
-
-    @Test
-    @DisplayName("Should get user reactively")
-    void shouldGetUserReactively() {
-        // Given
-        UserResponse user = new UserResponse(
-            1L,
-            "test@example.com",
-            "testuser",
-            25,
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.findById(1L)).thenReturn(Mono.just(user));
-
-        // When & Then
-        webTestClient.get()
-            .uri("/api/v1/users/{id}", 1L)
-            .accept(MediaType.APPLICATION_JSON)
-            .exchange()
-            .expectStatus().isOk()
-            .expectBody(UserResponse.class)
-            .value(response -> {
-                assertThat(response.id()).isEqualTo(1L);
-                assertThat(response.email()).isEqualTo("test@example.com");
-            });
-    }
-
-    @Test
-    @DisplayName("Should create user reactively")
-    void shouldCreateUserReactively() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        UserResponse response = new UserResponse(
-            1L,
-            request.email(),
-            request.username(),
-            request.age(),
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.create(any(UserCreateRequest.class))).thenReturn(Mono.just(response));
-
-        // When & Then
-        webTestClient.post()
-            .uri("/api/v1/users")
-            .contentType(MediaType.APPLICATION_JSON)
-            .body(Mono.just(request), UserCreateRequest.class)
-            .exchange()
-            .expectStatus().isCreated()
-            .expectHeader().exists("Location")
-            .expectBody(UserResponse.class)
-            .value(user -> {
-                assertThat(user.email()).isEqualTo(request.email());
-            });
-    }
-}
-```
-
-## Testing Configuration
-
-```java
-// application-test.yml
-spring:
-  datasource:
-    url: jdbc:h2:mem:testdb
-    driver-class-name: org.h2.Driver
-  jpa:
-    hibernate:
-      ddl-auto: create-drop
-    show-sql: true
-    properties:
-      hibernate:
-        format_sql: true
-  security:
-    user:
-      name: test
-      password: test
-
-logging:
-  level:
-    org.hibernate.SQL: DEBUG
-    org.hibernate.type.descriptor.sql.BasicBinder: TRACE
-
-// Test Configuration Class
-@TestConfiguration
-public class TestConfig {
-
-    @Bean
-    @Primary
-    public PasswordEncoder passwordEncoder() {
-        return new BCryptPasswordEncoder(4); // Faster for tests
-    }
-
-    @Bean
-    public Clock fixedClock() {
-        return Clock.fixed(
-            Instant.parse("2024-01-01T00:00:00Z"),
-            ZoneId.of("UTC")
-        );
-    }
-}
-```
-
-## Test Fixtures with @DataJpaTest
-
-```java
-@Component
-public class TestDataFactory {
-
-    public static User createUser(String email, String username) {
-        return User.builder()
-            .email(email)
-            .password("encodedPassword")
-            .username(username)
-            .active(true)
-            .createdAt(LocalDateTime.now())
-            .updatedAt(LocalDateTime.now())
-            .build();
-    }
-
-    public static UserCreateRequest createUserRequest() {
-        return new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@SpringBootTest` | Full application context integration test |
-| `@WebMvcTest` | Test MVC controllers with mocked services |
-| `@WebFluxTest` | Test reactive controllers |
-| `@DataJpaTest` | Test JPA repositories with in-memory database |
-| `@MockBean` | Add mock bean to Spring context |
-| `@WithMockUser` | Mock authenticated user for security tests |
-| `@Testcontainers` | Enable Testcontainers support |
-| `@ActiveProfiles` | Activate specific Spring profiles for test |
-
-## Testing Best Practices
-
-- Write tests following AAA pattern (Arrange, Act, Assert)
-- Use descriptive test names with @DisplayName
-- Mock external dependencies, use real DB with Testcontainers
-- Achieve 85%+ code coverage
-- Test happy path and edge cases
-- Use @Transactional for test data cleanup
-- Separate unit tests from integration tests
-- Use parameterized tests for multiple scenarios
-- Test security rules and validation
-- Keep tests fast and independent
diff --git a/.agent/skills/spring-boot-engineer/references/web.md b/.agent/skills/spring-boot-engineer/references/web.md
deleted file mode 100644
index 2eabbbb..0000000
--- a/.agent/skills/spring-boot-engineer/references/web.md
+++ /dev/null
@@ -1,295 +0,0 @@
-# Web Layer - Controllers & REST APIs
-
-## REST Controller Pattern
-
-```java
-@RestController
-@RequestMapping("/api/v1/users")
-@Validated
-@RequiredArgsConstructor
-public class UserController {
-    private final UserService userService;
-
-    @GetMapping
-    public ResponseEntity<Page<UserResponse>> getUsers(
-            @PageableDefault(size = 20, sort = "createdAt") Pageable pageable) {
-        Page<UserResponse> users = userService.findAll(pageable);
-        return ResponseEntity.ok(users);
-    }
-
-    @GetMapping("/{id}")
-    public ResponseEntity<UserResponse> getUser(@PathVariable Long id) {
-        UserResponse user = userService.findById(id);
-        return ResponseEntity.ok(user);
-    }
-
-    @PostMapping
-    public ResponseEntity<UserResponse> createUser(
-            @Valid @RequestBody UserCreateRequest request) {
-        UserResponse user = userService.create(request);
-        URI location = ServletUriComponentsBuilder
-                .fromCurrentRequest()
-                .path("/{id}")
-                .buildAndExpand(user.id())
-                .toUri();
-        return ResponseEntity.created(location).body(user);
-    }
-
-    @PutMapping("/{id}")
-    public ResponseEntity<UserResponse> updateUser(
-            @PathVariable Long id,
-            @Valid @RequestBody UserUpdateRequest request) {
-        UserResponse user = userService.update(id, request);
-        return ResponseEntity.ok(user);
-    }
-
-    @DeleteMapping("/{id}")
-    @ResponseStatus(HttpStatus.NO_CONTENT)
-    public void deleteUser(@PathVariable Long id) {
-        userService.delete(id);
-    }
-}
-```
-
-## Request DTOs with Validation
-
-```java
-public record UserCreateRequest(
-    @NotBlank(message = "Email is required")
-    @Email(message = "Email must be valid")
-    String email,
-
-    @NotBlank(message = "Password is required")
-    @Size(min = 8, max = 100, message = "Password must be 8-100 characters")
-    @Pattern(regexp = "^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).*$",
-             message = "Password must contain uppercase, lowercase, and digit")
-    String password,
-
-    @NotBlank(message = "Username is required")
-    @Size(min = 3, max = 50)
-    @Pattern(regexp = "^[a-zA-Z0-9_]+$", message = "Username must be alphanumeric")
-    String username,
-
-    @Min(value = 18, message = "Must be at least 18")
-    @Max(value = 120, message = "Must be at most 120")
-    Integer age
-) {}
-
-public record UserUpdateRequest(
-    @Email(message = "Email must be valid")
-    String email,
-
-    @Size(min = 3, max = 50)
-    String username
-) {}
-```
-
-## Response DTOs
-
-```java
-public record UserResponse(
-    Long id,
-    String email,
-    String username,
-    Integer age,
-    Boolean active,
-    LocalDateTime createdAt,
-    LocalDateTime updatedAt
-) {
-    public static UserResponse from(User user) {
-        return new UserResponse(
-            user.getId(),
-            user.getEmail(),
-            user.getUsername(),
-            user.getAge(),
-            user.getActive(),
-            user.getCreatedAt(),
-            user.getUpdatedAt()
-        );
-    }
-}
-```
-
-## Global Exception Handling
-
-```java
-@RestControllerAdvice
-@Slf4j
-public class GlobalExceptionHandler {
-
-    @ExceptionHandler(ResourceNotFoundException.class)
-    public ResponseEntity<ErrorResponse> handleNotFound(
-            ResourceNotFoundException ex, WebRequest request) {
-        log.error("Resource not found: {}", ex.getMessage());
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.NOT_FOUND.value(),
-            ex.getMessage(),
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.NOT_FOUND);
-    }
-
-    @ExceptionHandler(MethodArgumentNotValidException.class)
-    public ResponseEntity<ValidationErrorResponse> handleValidation(
-            MethodArgumentNotValidException ex) {
-        Map<String, String> errors = ex.getBindingResult()
-            .getFieldErrors()
-            .stream()
-            .collect(Collectors.toMap(
-                FieldError::getField,
-                error -> error.getDefaultMessage() != null
-                    ? error.getDefaultMessage()
-                    : "Invalid value"
-            ));
-
-        ValidationErrorResponse response = new ValidationErrorResponse(
-            HttpStatus.BAD_REQUEST.value(),
-            "Validation failed",
-            errors,
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(response, HttpStatus.BAD_REQUEST);
-    }
-
-    @ExceptionHandler(DataIntegrityViolationException.class)
-    public ResponseEntity<ErrorResponse> handleDataIntegrity(
-            DataIntegrityViolationException ex, WebRequest request) {
-        log.error("Data integrity violation", ex);
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.CONFLICT.value(),
-            "Data integrity violation - resource may already exist",
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.CONFLICT);
-    }
-
-    @ExceptionHandler(Exception.class)
-    public ResponseEntity<ErrorResponse> handleGlobalException(
-            Exception ex, WebRequest request) {
-        log.error("Unexpected error", ex);
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.INTERNAL_SERVER_ERROR.value(),
-            "An unexpected error occurred",
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.INTERNAL_SERVER_ERROR);
-    }
-}
-
-record ErrorResponse(
-    int status,
-    String message,
-    String path,
-    LocalDateTime timestamp
-) {}
-
-record ValidationErrorResponse(
-    int status,
-    String message,
-    Map<String, String> errors,
-    LocalDateTime timestamp
-) {}
-```
-
-## Custom Validation
-
-```java
-@Target({ElementType.FIELD, ElementType.PARAMETER})
-@Retention(RetentionPolicy.RUNTIME)
-@Constraint(validatedBy = UniqueEmailValidator.class)
-public @interface UniqueEmail {
-    String message() default "Email already exists";
-    Class<?>[] groups() default {};
-    Class<? extends Payload>[] payload() default {};
-}
-
-@Component
-@RequiredArgsConstructor
-public class UniqueEmailValidator implements ConstraintValidator<UniqueEmail, String> {
-    private final UserRepository userRepository;
-
-    @Override
-    public boolean isValid(String email, ConstraintValidatorContext context) {
-        if (email == null) return true;
-        return !userRepository.existsByEmail(email);
-    }
-}
-```
-
-## WebClient for External APIs
-
-```java
-@Configuration
-public class WebClientConfig {
-    @Bean
-    public WebClient webClient(WebClient.Builder builder) {
-        return builder
-            .baseUrl("https://api.example.com")
-            .defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
-            .filter(logRequest())
-            .build();
-    }
-
-    private ExchangeFilterFunction logRequest() {
-        return ExchangeFilterFunction.ofRequestProcessor(request -> {
-            log.info("Request: {} {}", request.method(), request.url());
-            return Mono.just(request);
-        });
-    }
-}
-
-@Service
-@RequiredArgsConstructor
-public class ExternalApiService {
-    private final WebClient webClient;
-
-    public Mono<ExternalDataResponse> fetchData(String id) {
-        return webClient
-            .get()
-            .uri("/data/{id}", id)
-            .retrieve()
-            .onStatus(HttpStatusCode::is4xxClientError, response ->
-                Mono.error(new ResourceNotFoundException("External resource not found")))
-            .onStatus(HttpStatusCode::is5xxServerError, response ->
-                Mono.error(new ServiceUnavailableException("External service unavailable")))
-            .bodyToMono(ExternalDataResponse.class)
-            .timeout(Duration.ofSeconds(5))
-            .retry(3);
-    }
-}
-```
-
-## CORS Configuration
-
-```java
-@Configuration
-public class WebConfig implements WebMvcConfigurer {
-
-    @Override
-    public void addCorsMappings(CorsRegistry registry) {
-        registry.addMapping("/api/**")
-            .allowedOrigins("http://localhost:3000", "https://example.com")
-            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
-            .allowedHeaders("*")
-            .allowCredentials(true)
-            .maxAge(3600);
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@RestController` | Marks class as REST controller (combines @Controller + @ResponseBody) |
-| `@RequestMapping` | Maps HTTP requests to handler methods |
-| `@GetMapping/@PostMapping` | HTTP method-specific mappings |
-| `@PathVariable` | Extracts values from URI path |
-| `@RequestParam` | Extracts query parameters |
-| `@RequestBody` | Binds request body to method parameter |
-| `@Valid` | Triggers validation on request body |
-| `@RestControllerAdvice` | Global exception handling for REST controllers |
-| `@ResponseStatus` | Sets HTTP status code for method |
diff --git a/.claude/skills/ai-engineer/SKILL.md b/.claude/skills/ai-engineer/SKILL.md
deleted file mode 100644
index e9d2cde..0000000
--- a/.claude/skills/ai-engineer/SKILL.md
+++ /dev/null
@@ -1,171 +0,0 @@
----
-name: ai-engineer
-description: Build production-ready LLM applications, advanced RAG systems, and
-  intelligent agents. Implements vector search, multimodal AI, agent
-  orchestration, and enterprise AI integrations. Use PROACTIVELY for LLM
-  features, chatbots, AI agents, or AI-powered applications.
-metadata:
-  model: inherit
----
-You are an AI engineer specializing in production-grade LLM applications, generative AI systems, and intelligent agent architectures.
-
-## Use this skill when
-
-- Building or improving LLM features, RAG systems, or AI agents
-- Designing production AI architectures and model integration
-- Optimizing vector search, embeddings, or retrieval pipelines
-- Implementing AI safety, monitoring, or cost controls
-
-## Do not use this skill when
-
-- The task is pure data science or traditional ML without LLMs
-- You only need a quick UI change unrelated to AI features
-- There is no access to data sources or deployment targets
-
-## Instructions
-
-1. Clarify use cases, constraints, and success metrics.
-2. Design the AI architecture, data flow, and model selection.
-3. Implement with monitoring, safety, and cost controls.
-4. Validate with tests and staged rollout plans.
-
-## Safety
-
-- Avoid sending sensitive data to external models without approval.
-- Add guardrails for prompt injection, PII, and policy compliance.
-
-## Purpose
-Expert AI engineer specializing in LLM application development, RAG systems, and AI agent architectures. Masters both traditional and cutting-edge generative AI patterns, with deep knowledge of the modern AI stack including vector databases, embedding models, agent frameworks, and multimodal AI systems.
-
-## Capabilities
-
-### LLM Integration & Model Management
-- OpenAI GPT-4o/4o-mini, o1-preview, o1-mini with function calling and structured outputs
-- Anthropic Claude 4.5 Sonnet/Haiku, Claude 4.1 Opus with tool use and computer use
-- Open-source models: Llama 3.1/3.2, Mixtral 8x7B/8x22B, Qwen 2.5, DeepSeek-V2
-- Local deployment with Ollama, vLLM, TGI (Text Generation Inference)
-- Model serving with TorchServe, MLflow, BentoML for production deployment
-- Multi-model orchestration and model routing strategies
-- Cost optimization through model selection and caching strategies
-
-### Advanced RAG Systems
-- Production RAG architectures with multi-stage retrieval pipelines
-- Vector databases: Pinecone, Qdrant, Weaviate, Chroma, Milvus, pgvector
-- Embedding models: OpenAI text-embedding-3-large/small, Cohere embed-v3, BGE-large
-- Chunking strategies: semantic, recursive, sliding window, and document-structure aware
-- Hybrid search combining vector similarity and keyword matching (BM25)
-- Reranking with Cohere rerank-3, BGE reranker, or cross-encoder models
-- Query understanding with query expansion, decomposition, and routing
-- Context compression and relevance filtering for token optimization
-- Advanced RAG patterns: GraphRAG, HyDE, RAG-Fusion, self-RAG
-
-### Agent Frameworks & Orchestration
-- LangChain/LangGraph for complex agent workflows and state management
-- LlamaIndex for data-centric AI applications and advanced retrieval
-- CrewAI for multi-agent collaboration and specialized agent roles
-- AutoGen for conversational multi-agent systems
-- OpenAI Assistants API with function calling and file search
-- Agent memory systems: short-term, long-term, and episodic memory
-- Tool integration: web search, code execution, API calls, database queries
-- Agent evaluation and monitoring with custom metrics
-
-### Vector Search & Embeddings
-- Embedding model selection and fine-tuning for domain-specific tasks
-- Vector indexing strategies: HNSW, IVF, LSH for different scale requirements
-- Similarity metrics: cosine, dot product, Euclidean for various use cases
-- Multi-vector representations for complex document structures
-- Embedding drift detection and model versioning
-- Vector database optimization: indexing, sharding, and caching strategies
-
-### Prompt Engineering & Optimization
-- Advanced prompting techniques: chain-of-thought, tree-of-thoughts, self-consistency
-- Few-shot and in-context learning optimization
-- Prompt templates with dynamic variable injection and conditioning
-- Constitutional AI and self-critique patterns
-- Prompt versioning, A/B testing, and performance tracking
-- Safety prompting: jailbreak detection, content filtering, bias mitigation
-- Multi-modal prompting for vision and audio models
-
-### Production AI Systems
-- LLM serving with FastAPI, async processing, and load balancing
-- Streaming responses and real-time inference optimization
-- Caching strategies: semantic caching, response memoization, embedding caching
-- Rate limiting, quota management, and cost controls
-- Error handling, fallback strategies, and circuit breakers
-- A/B testing frameworks for model comparison and gradual rollouts
-- Observability: logging, metrics, tracing with LangSmith, Phoenix, Weights & Biases
-
-### Multimodal AI Integration
-- Vision models: GPT-4V, Claude 4 Vision, LLaVA, CLIP for image understanding
-- Audio processing: Whisper for speech-to-text, ElevenLabs for text-to-speech
-- Document AI: OCR, table extraction, layout understanding with models like LayoutLM
-- Video analysis and processing for multimedia applications
-- Cross-modal embeddings and unified vector spaces
-
-### AI Safety & Governance
-- Content moderation with OpenAI Moderation API and custom classifiers
-- Prompt injection detection and prevention strategies
-- PII detection and redaction in AI workflows
-- Model bias detection and mitigation techniques
-- AI system auditing and compliance reporting
-- Responsible AI practices and ethical considerations
-
-### Data Processing & Pipeline Management
-- Document processing: PDF extraction, web scraping, API integrations
-- Data preprocessing: cleaning, normalization, deduplication
-- Pipeline orchestration with Apache Airflow, Dagster, Prefect
-- Real-time data ingestion with Apache Kafka, Pulsar
-- Data versioning with DVC, lakeFS for reproducible AI pipelines
-- ETL/ELT processes for AI data preparation
-
-### Integration & API Development
-- RESTful API design for AI services with FastAPI, Flask
-- GraphQL APIs for flexible AI data querying
-- Webhook integration and event-driven architectures
-- Third-party AI service integration: Azure OpenAI, AWS Bedrock, GCP Vertex AI
-- Enterprise system integration: Slack bots, Microsoft Teams apps, Salesforce
-- API security: OAuth, JWT, API key management
-
-## Behavioral Traits
-- Prioritizes production reliability and scalability over proof-of-concept implementations
-- Implements comprehensive error handling and graceful degradation
-- Focuses on cost optimization and efficient resource utilization
-- Emphasizes observability and monitoring from day one
-- Considers AI safety and responsible AI practices in all implementations
-- Uses structured outputs and type safety wherever possible
-- Implements thorough testing including adversarial inputs
-- Documents AI system behavior and decision-making processes
-- Stays current with rapidly evolving AI/ML landscape
-- Balances cutting-edge techniques with proven, stable solutions
-
-## Knowledge Base
-- Latest LLM developments and model capabilities (GPT-4o, Claude 4.5, Llama 3.2)
-- Modern vector database architectures and optimization techniques
-- Production AI system design patterns and best practices
-- AI safety and security considerations for enterprise deployments
-- Cost optimization strategies for LLM applications
-- Multimodal AI integration and cross-modal learning
-- Agent frameworks and multi-agent system architectures
-- Real-time AI processing and streaming inference
-- AI observability and monitoring best practices
-- Prompt engineering and optimization methodologies
-
-## Response Approach
-1. **Analyze AI requirements** for production scalability and reliability
-2. **Design system architecture** with appropriate AI components and data flow
-3. **Implement production-ready code** with comprehensive error handling
-4. **Include monitoring and evaluation** metrics for AI system performance
-5. **Consider cost and latency** implications of AI service usage
-6. **Document AI behavior** and provide debugging capabilities
-7. **Implement safety measures** for responsible AI deployment
-8. **Provide testing strategies** including adversarial and edge cases
-
-## Example Interactions
-- "Build a production RAG system for enterprise knowledge base with hybrid search"
-- "Implement a multi-agent customer service system with escalation workflows"
-- "Design a cost-optimized LLM inference pipeline with caching and load balancing"
-- "Create a multimodal AI system for document analysis and question answering"
-- "Build an AI agent that can browse the web and perform research tasks"
-- "Implement semantic search with reranking for improved retrieval accuracy"
-- "Design an A/B testing framework for comparing different LLM prompts"
-- "Create a real-time AI content moderation system with custom classifiers"
diff --git a/.claude/skills/machine-learning-engineer/SKILL.md b/.claude/skills/machine-learning-engineer/SKILL.md
deleted file mode 100644
index e1e80c7..0000000
--- a/.claude/skills/machine-learning-engineer/SKILL.md
+++ /dev/null
@@ -1,356 +0,0 @@
----
-name: machine-learning-engineer
-description: Use when user needs ML model deployment, production serving infrastructure, optimization strategies, and real-time inference systems. Designs and implements scalable ML systems with focus on reliability and performance.
----
-
-# Machine Learning Engineer
-
-## Purpose
-
-Provides ML engineering expertise specializing in model deployment, production serving infrastructure, and real-time inference systems. Designs scalable ML platforms with model optimization, auto-scaling, and monitoring for reliable production machine learning workloads.
-
-## When to Use
-
-- ML model deployment to production
-- Real-time inference API development
-- Model optimization and compression
-- Batch prediction systems
-- Auto-scaling and load balancing
-- Edge deployment for IoT/mobile
-- Multi-model serving orchestration
-- Performance tuning and latency optimization
-
-This skill provides expert ML engineering capabilities for deploying and serving machine learning models at scale. It focuses on model optimization, inference infrastructure, real-time serving, and edge deployment with emphasis on building reliable, performant ML systems for production workloads.
-
-## When to Use
-
-User needs:
-- ML model deployment to production
-- Real-time inference API development
-- Model optimization and compression
-- Batch prediction systems
-- Auto-scaling and load balancing
-- Edge deployment for IoT/mobile
-- Multi-model serving orchestration
-- Performance tuning and latency optimization
-
-## What This Skill Does
-
-This skill deploys ML models to production with comprehensive infrastructure. It optimizes models for inference, builds serving pipelines, configures auto-scaling, implements monitoring, and ensures models meet performance, reliability, and scalability requirements in production environments.
-
-### ML Deployment Components
-
-- Model optimization and compression
-- Serving infrastructure (REST/gRPC APIs, batch jobs)
-- Load balancing and request routing
-- Auto-scaling and resource management
-- Real-time and batch prediction systems
-- Monitoring, logging, and observability
-- Edge deployment and model compression
-- A/B testing and canary deployments
-
-## Core Capabilities
-
-### Model Deployment Pipelines
-- CI/CD integration for ML models
-- Automated testing and validation
-- Model performance benchmarking
-- Security scanning and vulnerability assessment
-- Container building and registry management
-- Progressive rollout and blue-green deployment
-
-### Serving Infrastructure
-- Load balancer configuration (NGINX, HAProxy)
-- Request routing and model caching
-- Connection pooling and health checking
-- Graceful shutdown and resource allocation
-- Multi-region deployment and failover
-- Container orchestration (Kubernetes, ECS)
-
-### Model Optimization
-- Quantization (FP32, FP16, INT8, INT4)
-- Model pruning and sparsification
-- Knowledge distillation techniques
-- ONNX and TensorRT conversion
-- Graph optimization and operator fusion
-- Memory optimization and throughput tuning
-
-### Real-time Inference
-- Request preprocessing and validation
-- Model prediction execution
-- Response formatting and error handling
-- Timeout management and circuit breaking
-- Request batching and response caching
-- Streaming predictions and async processing
-
-### Batch Prediction Systems
-- Job scheduling and orchestration
-- Data partitioning and parallel processing
-- Progress tracking and error handling
-- Result aggregation and storage
-- Cost optimization and resource management
-
-### Auto-scaling Strategies
-- Metric-based scaling (CPU, GPU, request rate)
-- Scale-up and scale-down policies
-- Warm-up periods and predictive scaling
-- Cost controls and regional distribution
-- Traffic prediction and capacity planning
-
-### Multi-model Serving
-- Model routing and version management
-- A/B testing and traffic splitting
-- Ensemble serving and model cascading
-- Fallback strategies and performance isolation
-- Shadow mode testing and validation
-
-### Edge Deployment
-- Model compression for edge devices
-- Hardware optimization and power efficiency
-- Offline capability and update mechanisms
-- Telemetry collection and security hardening
-- Resource constraints and optimization
-
-## Tool Restrictions
-
-- Read: Access model artifacts, infrastructure configs, and monitoring data
-- Write/Edit: Create deployment configs, serving code, and optimization scripts
-- Bash: Execute deployment commands, monitoring setup, and performance tests
-- Glob/Grep: Search codebases for model integration and serving endpoints
-
-## Integration with Other Skills
-
-- ml-engineer: Model optimization and training pipeline integration
-- mlops-engineer: Infrastructure and platform setup
-- data-engineer: Data pipelines and feature stores
-- devops-engineer: CI/CD and deployment automation
-- cloud-architect: Cloud infrastructure and architecture
-- sre-engineer: Reliability and availability
-- performance-engineer: Performance profiling and optimization
-- ai-engineer: Model selection and integration
-
-## Example Interactions
-
-### Scenario 1: Real-time Inference API Deployment
-
-**User:** "Deploy our ML model as a real-time API with auto-scaling"
-
-**Interaction:**
-1. Skill analyzes model characteristics and requirements
-2. Implements serving infrastructure:
-   - Optimizes model with ONNX conversion (60% size reduction)
-   - Creates FastAPI/gRPC serving endpoints
-   - Configures GPU auto-scaling based on request rate
-   - Implements request batching for throughput
-   - Sets up monitoring and alerting
-3. Deploys to Kubernetes with horizontal pod autoscaler
-4. Achieves <50ms P99 latency and 2000+ RPS throughput
-
-### Scenario 2: Multi-model Serving Platform
-
-**User:** "Build a platform to serve 50+ models with intelligent routing"
-
-**Interaction:**
-1. Skill designs multi-model architecture:
-   - Model registry and version management
-   - Intelligent routing based on request type
-   - Specialist models for different use cases
-   - Fallback and circuit breaking
-   - Cost optimization with smaller models for simple queries
-2. Implements serving framework with:
-   - Model loading and unloading
-   - Request queuing and load balancing
-   - A/B testing and traffic splitting
-   - Ensemble serving for critical paths
-3. Deploys with comprehensive monitoring and cost tracking
-
-### Scenario 3: Edge Deployment for IoT
-
-**User:** "Deploy ML model to edge devices with limited resources"
-
-**Interaction:**
-1. Skill analyzes device constraints and requirements
-2. Optimizes model for edge:
-   - Quantizes to INT8 (4x size reduction)
-   - Prunes and compresses model
-   - Implements ONNX Runtime for efficient inference
-   - Adds offline capability and local caching
-3. Creates deployment package:
-   - Edge-optimized inference runtime
-   - Update mechanism with delta updates
-   - Telemetry collection and monitoring
-   - Security hardening and encryption
-4. Tests on target hardware and validates performance
-
-## Best Practices
-
-- Performance: Target <100ms P99 latency for real-time inference
-- Reliability: Implement graceful degradation and fallback models
-- Monitoring: Track latency, throughput, error rates, and resource usage
-- Testing: Conduct load testing and validate against production traffic patterns
-- Security: Implement authentication, encryption, and model security
-- Documentation: Document all deployment configurations and operational procedures
-- Cost: Optimize resource usage and implement auto-scaling for cost efficiency
-
-## Examples
-
-### Example 1: Real-Time Inference API for Production
-
-**Scenario:** Deploy a fraud detection model as a real-time API with auto-scaling.
-
-**Deployment Approach:**
-1. **Model Optimization**: Converted model to ONNX (60% size reduction)
-2. **Serving Framework**: Built FastAPI endpoints with async processing
-3. **Infrastructure**: Kubernetes deployment with Horizontal Pod Autoscaler
-4. **Monitoring**: Integrated Prometheus metrics and Grafana dashboards
-
-**Configuration:**
-```python
-# FastAPI serving with optimization
-from fastapi import FastAPI
-import onnxruntime as ort
-
-app = FastAPI()
-session = ort.InferenceSession("model.onnx")
-
-@app.post("/predict")
-async def predict(features: List[float]):
-    input_tensor = np.array([features])
-    outputs = session.run(None, {"input": input_tensor})
-    return {"prediction": outputs[0].tolist()}
-```
-
-**Performance Results:**
-| Metric | Value |
-|--------|-------|
-| P99 Latency | 45ms |
-| Throughput | 2,500 RPS |
-| Availability | 99.99% |
-| Auto-scaling | 2-50 pods |
-
-### Example 2: Multi-Model Serving Platform
-
-**Scenario:** Build a platform serving 50+ ML models for different prediction types.
-
-**Architecture Design:**
-1. **Model Registry**: Central registry with versioning
-2. **Router**: Intelligent routing based on request type
-3. **Resource Manager**: Dynamic resource allocation per model
-4. **Fallback System**: Graceful degradation for unavailable models
-
-**Implementation:**
-- Model loading/unloading based on request patterns
-- A/B testing framework for model comparisons
-- Cost optimization with model prioritization
-- Shadow mode testing for new models
-
-**Results:**
-- 50+ models deployed with 99.9% uptime
-- 40% reduction in infrastructure costs
-- Zero downtime during model updates
-- 95% cache hit rate for frequent requests
-
-### Example 3: Edge Deployment for Mobile Devices
-
-**Scenario:** Deploy image classification model to iOS and Android apps.
-
-**Edge Optimization:**
-1. **Model Compression**: Quantized to INT8 (4x size reduction)
-2. **Runtime Selection**: CoreML for iOS, TFLite for Android
-3. **On-Device Caching**: Intelligent model caching and updates
-4. **Privacy Compliance**: All processing on-device
-
-**Performance Metrics:**
-| Platform | Model Size | Inference Time | Accuracy |
-|----------|------------|----------------|----------|
-| Original | 25 MB | 150ms | 94.2% |
-| Optimized | 6 MB | 35ms | 93.8% |
-
-**Results:**
-- 80% reduction in app download size
-- 4x faster inference on device
-- Offline capability with local inference
-- GDPR compliant (no data leaves device)
-
-## Best Practices
-
-### Model Optimization
-
-- **Quantization**: Start with FP16, move to INT8 for edge
-- **Pruning**: Remove unnecessary weights for efficiency
-- **Distillation**: Transfer knowledge to smaller models
-- **ONNX Export**: Standard format for cross-platform deployment
-- **Benchmarking**: Always test on target hardware
-
-### Production Serving
-
-- **Health Checks**: Implement /health and /ready endpoints
-- **Graceful Degradation**: Fallback to simpler models or heuristics
-- **Circuit Breakers**: Prevent cascade failures
-- **Rate Limiting**: Protect against abuse and overuse
-- **Caching**: Cache predictions for identical inputs
-
-### Monitoring and Observability
-
-- **Latency Tracking**: Monitor P50, P95, P99 latencies
-- **Error Rates**: Track failures and error types
-- **Prediction Distribution**: Alert on distribution shifts
-- **Resource Usage**: CPU, GPU, memory monitoring
-- **Business Metrics**: Track model impact on KPIs
-
-### Security and Compliance
-
-- **Model Security**: Protect model weights and artifacts
-- **Input Validation**: Sanitize all prediction inputs
-- **Output Filtering**: Prevent sensitive data exposure
-- **Audit Logging**: Log all prediction requests
-- **Compliance**: Meet industry regulations (HIPAA, GDPR)
-
-## Anti-Patterns
-
-### Model Deployment Anti-Patterns
-
-- **Manual Deployment**: Deploying models without automation - implement CI/CD for models
-- **No Versioning**: Replacing models without tracking versions - maintain model version history
-- **Hotfix Culture**: Making urgent model changes without testing - require validation before deployment
-- **Black Box Deployment**: Deploying models without explainability - implement model interpretability
-
-### Performance Anti-Patterns
-
-- **No Baselines**: Deploying without performance benchmarks - establish performance baselines
-- **Over-Optimization**: Tuning beyond practical benefit - focus on customer-impacting metrics
-- **Ignore Latency**: Focusing only on accuracy, ignoring latency - optimize for real-world use cases
-- **Resource Waste**: Over-provisioning infrastructure - right-size resources based on actual load
-
-### Monitoring Anti-Patterns
-
-- **Silent Failures**: Models failing without detection - implement comprehensive health checks
-- **Metric Overload**: Monitoring too many metrics - focus on actionable metrics
-- **Data Drift Blindness**: Not detecting model degradation - monitor input data distribution
-- **Alert Fatigue**: Too many alerts causing ignored warnings - tune alert thresholds
-
-### Scalability Anti-Patterns
-
-- **No Load Testing**: Deploying without performance testing - test with production-like traffic
-- **Single Point of Failure**: No redundancy in serving infrastructure - implement failover
-- **No Autoscaling**: Manual capacity management - implement automatic scaling
-- **Stateful Design**: Inference that requires state - design stateless inference
-
-## Output Format
-
-This skill delivers:
-- Complete model serving infrastructure (Docker, Kubernetes configs)
-- Production deployment pipelines and CI/CD workflows
-- Real-time and batch prediction APIs
-- Model optimization artifacts and configurations
-- Auto-scaling policies and infrastructure as code
-- Monitoring dashboards and alert configurations
-- Performance benchmarks and load test reports
-
-All outputs include:
-- Detailed architecture documentation
-- Deployment scripts and configurations
-- Performance metrics and SLA validations
-- Security hardening guidelines
-- Operational runbooks and troubleshooting guides
-- Cost analysis and optimization recommendations
diff --git a/.claude/skills/senior-backend/SKILL.md b/.claude/skills/senior-backend/SKILL.md
deleted file mode 100644
index 0ae08a6..0000000
--- a/.claude/skills/senior-backend/SKILL.md
+++ /dev/null
@@ -1,434 +0,0 @@
----
-name: senior-backend
-description: This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Use for Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns.
----
-
-# Senior Backend Engineer
-
-Backend development patterns, API design, database optimization, and security practices.
-
-## Table of Contents
-
-- [Quick Start](#quick-start)
-- [Tools Overview](#tools-overview)
-  - [API Scaffolder](#1-api-scaffolder)
-  - [Database Migration Tool](#2-database-migration-tool)
-  - [API Load Tester](#3-api-load-tester)
-- [Backend Development Workflows](#backend-development-workflows)
-  - [API Design Workflow](#api-design-workflow)
-  - [Database Optimization Workflow](#database-optimization-workflow)
-  - [Security Hardening Workflow](#security-hardening-workflow)
-- [Reference Documentation](#reference-documentation)
-- [Common Patterns Quick Reference](#common-patterns-quick-reference)
-
----
-
-## Quick Start
-
-```bash
-# Generate API routes from OpenAPI spec
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-
-# Analyze database schema and generate migrations
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb --analyze
-
-# Load test an API endpoint
-python scripts/api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-```
-
----
-
-## Tools Overview
-
-### 1. API Scaffolder
-
-Generates API route handlers, middleware, and OpenAPI specifications from schema definitions.
-
-**Input:** OpenAPI spec (YAML/JSON) or database schema
-**Output:** Route handlers, validation middleware, TypeScript types
-
-**Usage:**
-```bash
-# Generate Express routes from OpenAPI spec
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-
-# Output:
-# Generated 12 route handlers in src/routes/
-# - GET /users (listUsers)
-# - POST /users (createUser)
-# - GET /users/{id} (getUser)
-# - PUT /users/{id} (updateUser)
-# - DELETE /users/{id} (deleteUser)
-# ...
-# Created validation middleware: src/middleware/validators.ts
-# Created TypeScript types: src/types/api.ts
-
-# Generate from database schema
-python scripts/api_scaffolder.py --from-db postgres://localhost/mydb --output src/routes/
-
-# Generate OpenAPI spec from existing routes
-python scripts/api_scaffolder.py src/routes/ --generate-spec --output openapi.yaml
-```
-
-**Supported Frameworks:**
-- Express.js (`--framework express`)
-- Fastify (`--framework fastify`)
-- Koa (`--framework koa`)
-
----
-
-### 2. Database Migration Tool
-
-Analyzes database schemas, detects changes, and generates migration files with rollback support.
-
-**Input:** Database connection string or schema files
-**Output:** Migration files, schema diff report, optimization suggestions
-
-**Usage:**
-```bash
-# Analyze current schema and suggest optimizations
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb --analyze
-
-# Output:
-# === Database Analysis Report ===
-# Tables: 24
-# Total rows: 1,247,832
-#
-# MISSING INDEXES (5 found):
-#   orders.user_id - 847ms avg query time, ADD INDEX recommended
-#   products.category_id - 234ms avg query time, ADD INDEX recommended
-#
-# N+1 QUERY RISKS (3 found):
-#   users -> orders relationship (no eager loading)
-#
-# SUGGESTED MIGRATIONS:
-#   1. Add index on orders(user_id)
-#   2. Add index on products(category_id)
-#   3. Add composite index on order_items(order_id, product_id)
-
-# Generate migration from schema diff
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb \
-  --compare schema/v2.sql --output migrations/
-
-# Output:
-# Generated migration: migrations/20240115_add_user_indexes.sql
-# Generated rollback: migrations/20240115_add_user_indexes_rollback.sql
-
-# Dry-run a migration
-python scripts/database_migration_tool.py --connection postgres://localhost/mydb \
-  --migrate migrations/20240115_add_user_indexes.sql --dry-run
-```
-
----
-
-### 3. API Load Tester
-
-Performs HTTP load testing with configurable concurrency, measuring latency percentiles and throughput.
-
-**Input:** API endpoint URL and test configuration
-**Output:** Performance report with latency distribution, error rates, throughput metrics
-
-**Usage:**
-```bash
-# Basic load test
-python scripts/api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-
-# Output:
-# === Load Test Results ===
-# Target: https://api.example.com/users
-# Duration: 30s | Concurrency: 50
-#
-# THROUGHPUT:
-#   Total requests: 15,247
-#   Requests/sec: 508.2
-#   Successful: 15,102 (99.0%)
-#   Failed: 145 (1.0%)
-#
-# LATENCY (ms):
-#   Min: 12
-#   Avg: 89
-#   P50: 67
-#   P95: 198
-#   P99: 423
-#   Max: 1,247
-#
-# ERRORS:
-#   Connection timeout: 89
-#   HTTP 503: 56
-#
-# RECOMMENDATION: P99 latency (423ms) exceeds 200ms target.
-# Consider: connection pooling, query optimization, or horizontal scaling.
-
-# Test with custom headers and body
-python scripts/api_load_tester.py https://api.example.com/orders \
-  --method POST \
-  --header "Authorization: Bearer token123" \
-  --body '{"product_id": 1, "quantity": 2}' \
-  --concurrency 100 \
-  --duration 60
-
-# Compare two endpoints
-python scripts/api_load_tester.py https://api.example.com/v1/users https://api.example.com/v2/users \
-  --compare --concurrency 50 --duration 30
-```
-
----
-
-## Backend Development Workflows
-
-### API Design Workflow
-
-Use when designing a new API or refactoring existing endpoints.
-
-**Step 1: Define resources and operations**
-```yaml
-# openapi.yaml
-openapi: 3.0.3
-info:
-  title: User Service API
-  version: 1.0.0
-paths:
-  /users:
-    get:
-      summary: List users
-      parameters:
-        - name: limit
-          in: query
-          schema:
-            type: integer
-            default: 20
-    post:
-      summary: Create user
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateUser'
-```
-
-**Step 2: Generate route scaffolding**
-```bash
-python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/
-```
-
-**Step 3: Implement business logic**
-```typescript
-// src/routes/users.ts (generated, then customized)
-export const createUser = async (req: Request, res: Response) => {
-  const { email, name } = req.body;
-
-  // Add business logic
-  const user = await userService.create({ email, name });
-
-  res.status(201).json(user);
-};
-```
-
-**Step 4: Add validation middleware**
-```bash
-# Validation is auto-generated from OpenAPI schema
-# src/middleware/validators.ts includes:
-# - Request body validation
-# - Query parameter validation
-# - Path parameter validation
-```
-
-**Step 5: Generate updated OpenAPI spec**
-```bash
-python scripts/api_scaffolder.py src/routes/ --generate-spec --output openapi.yaml
-```
-
----
-
-### Database Optimization Workflow
-
-Use when queries are slow or database performance needs improvement.
-
-**Step 1: Analyze current performance**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-```
-
-**Step 2: Identify slow queries**
-```sql
--- Check query execution plans
-EXPLAIN ANALYZE SELECT * FROM orders
-WHERE user_id = 123
-ORDER BY created_at DESC
-LIMIT 10;
-
--- Look for: Seq Scan (bad), Index Scan (good)
-```
-
-**Step 3: Generate index migrations**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --suggest-indexes --output migrations/
-```
-
-**Step 4: Test migration (dry-run)**
-```bash
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --migrate migrations/add_indexes.sql --dry-run
-```
-
-**Step 5: Apply and verify**
-```bash
-# Apply migration
-python scripts/database_migration_tool.py --connection $DATABASE_URL \
-  --migrate migrations/add_indexes.sql
-
-# Verify improvement
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-```
-
----
-
-### Security Hardening Workflow
-
-Use when preparing an API for production or after a security review.
-
-**Step 1: Review authentication setup**
-```typescript
-// Verify JWT configuration
-const jwtConfig = {
-  secret: process.env.JWT_SECRET,  // Must be from env, never hardcoded
-  expiresIn: '1h',                 // Short-lived tokens
-  algorithm: 'RS256'               // Prefer asymmetric
-};
-```
-
-**Step 2: Add rate limiting**
-```typescript
-import rateLimit from 'express-rate-limit';
-
-const apiLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,  // 15 minutes
-  max: 100,                   // 100 requests per window
-  standardHeaders: true,
-  legacyHeaders: false,
-});
-
-app.use('/api/', apiLimiter);
-```
-
-**Step 3: Validate all inputs**
-```typescript
-import { z } from 'zod';
-
-const CreateUserSchema = z.object({
-  email: z.string().email().max(255),
-  name: z.string().min(1).max(100),
-  age: z.number().int().positive().optional()
-});
-
-// Use in route handler
-const data = CreateUserSchema.parse(req.body);
-```
-
-**Step 4: Load test with attack patterns**
-```bash
-# Test rate limiting
-python scripts/api_load_tester.py https://api.example.com/login \
-  --concurrency 200 --duration 10 --expect-rate-limit
-
-# Test input validation
-python scripts/api_load_tester.py https://api.example.com/users \
-  --method POST \
-  --body '{"email": "not-an-email"}' \
-  --expect-status 400
-```
-
-**Step 5: Review security headers**
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet({
-  contentSecurityPolicy: true,
-  crossOriginEmbedderPolicy: true,
-  crossOriginOpenerPolicy: true,
-  crossOriginResourcePolicy: true,
-  hsts: { maxAge: 31536000, includeSubDomains: true },
-}));
-```
-
----
-
-## Reference Documentation
-
-| File | Contains | Use When |
-|------|----------|----------|
-| `references/api_design_patterns.md` | REST vs GraphQL, versioning, error handling, pagination | Designing new APIs |
-| `references/database_optimization_guide.md` | Indexing strategies, query optimization, N+1 solutions | Fixing slow queries |
-| `references/backend_security_practices.md` | OWASP Top 10, auth patterns, input validation | Security hardening |
-
----
-
-## Common Patterns Quick Reference
-
-### REST API Response Format
-```json
-{
-  "data": { "id": 1, "name": "John" },
-  "meta": { "requestId": "abc-123" }
-}
-```
-
-### Error Response Format
-```json
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid email format",
-    "details": [{ "field": "email", "message": "must be valid email" }]
-  },
-  "meta": { "requestId": "abc-123" }
-}
-```
-
-### HTTP Status Codes
-| Code | Use Case |
-|------|----------|
-| 200 | Success (GET, PUT, PATCH) |
-| 201 | Created (POST) |
-| 204 | No Content (DELETE) |
-| 400 | Validation error |
-| 401 | Authentication required |
-| 403 | Permission denied |
-| 404 | Resource not found |
-| 429 | Rate limit exceeded |
-| 500 | Internal server error |
-
-### Database Index Strategy
-```sql
--- Single column (equality lookups)
-CREATE INDEX idx_users_email ON users(email);
-
--- Composite (multi-column queries)
-CREATE INDEX idx_orders_user_status ON orders(user_id, status);
-
--- Partial (filtered queries)
-CREATE INDEX idx_orders_active ON orders(created_at) WHERE status = 'active';
-
--- Covering (avoid table lookup)
-CREATE INDEX idx_users_email_name ON users(email) INCLUDE (name);
-```
-
----
-
-## Common Commands
-
-```bash
-# API Development
-python scripts/api_scaffolder.py openapi.yaml --framework express
-python scripts/api_scaffolder.py src/routes/ --generate-spec
-
-# Database Operations
-python scripts/database_migration_tool.py --connection $DATABASE_URL --analyze
-python scripts/database_migration_tool.py --connection $DATABASE_URL --migrate file.sql
-
-# Performance Testing
-python scripts/api_load_tester.py https://api.example.com/endpoint --concurrency 50
-python scripts/api_load_tester.py https://api.example.com/endpoint --compare baseline.json
-```
diff --git a/.claude/skills/senior-backend/references/api_design_patterns.md b/.claude/skills/senior-backend/references/api_design_patterns.md
deleted file mode 100644
index e45a976..0000000
--- a/.claude/skills/senior-backend/references/api_design_patterns.md
+++ /dev/null
@@ -1,530 +0,0 @@
-# API Design Patterns
-
-Concrete patterns for REST and GraphQL API design with examples.
-
-## Patterns Index
-
-1. [REST vs GraphQL Decision](#1-rest-vs-graphql-decision)
-2. [Resource Naming Conventions](#2-resource-naming-conventions)
-3. [API Versioning Strategies](#3-api-versioning-strategies)
-4. [Error Handling Patterns](#4-error-handling-patterns)
-5. [Pagination Patterns](#5-pagination-patterns)
-6. [Authentication Patterns](#6-authentication-patterns)
-7. [Rate Limiting Design](#7-rate-limiting-design)
-8. [Idempotency Patterns](#8-idempotency-patterns)
-
----
-
-## 1. REST vs GraphQL Decision
-
-### When to Use REST
-
-| Scenario | Why REST |
-|----------|----------|
-| Simple CRUD operations | Less complexity, widely understood |
-| Public APIs | Better caching, easier documentation |
-| File uploads/downloads | Native HTTP support |
-| Microservices communication | Simpler service-to-service calls |
-| Caching is critical | HTTP caching built-in |
-
-### When to Use GraphQL
-
-| Scenario | Why GraphQL |
-|----------|-------------|
-| Mobile apps with bandwidth constraints | Request only needed fields |
-| Complex nested data | Single request for related data |
-| Rapidly changing frontend requirements | Frontend-driven queries |
-| Multiple client types | Each client queries what it needs |
-| Real-time subscriptions needed | Built-in subscription support |
-
-### Hybrid Approach
-
-```
-┌─────────────────────────────────────────────────────┐
-│                    API Gateway                       │
-├─────────────────────────────────────────────────────┤
-│  /api/v1/*  →  REST (Public API, webhooks)          │
-│  /graphql   →  GraphQL (Mobile apps, dashboards)    │
-│  /files/*   →  REST (File uploads/downloads)        │
-└─────────────────────────────────────────────────────┘
-```
-
----
-
-## 2. Resource Naming Conventions
-
-### REST Endpoint Patterns
-
-```
-# Collections (plural nouns)
-GET    /users              # List users
-POST   /users              # Create user
-GET    /users/{id}         # Get user
-PUT    /users/{id}         # Replace user
-PATCH  /users/{id}         # Update user
-DELETE /users/{id}         # Delete user
-
-# Nested resources
-GET    /users/{id}/orders          # User's orders
-POST   /users/{id}/orders          # Create order for user
-GET    /users/{id}/orders/{orderId} # Specific order
-
-# Actions (when CRUD doesn't fit)
-POST   /users/{id}/activate        # Activate user
-POST   /orders/{id}/cancel         # Cancel order
-POST   /payments/{id}/refund       # Refund payment
-
-# Filtering, sorting, pagination
-GET    /users?status=active&sort=-created_at&limit=20&offset=40
-GET    /orders?user_id=123&status=pending
-```
-
-### Naming Rules
-
-| Rule | Good | Bad |
-|------|------|-----|
-| Use plural nouns | `/users` | `/user` |
-| Use lowercase | `/user-profiles` | `/userProfiles` |
-| Use hyphens | `/order-items` | `/order_items` |
-| No verbs in URLs | `POST /orders` | `POST /createOrder` |
-| No file extensions | `/users/123` | `/users/123.json` |
-
----
-
-## 3. API Versioning Strategies
-
-### Strategy Comparison
-
-| Strategy | Example | Pros | Cons |
-|----------|---------|------|------|
-| URL Path | `/api/v1/users` | Explicit, easy routing | URL changes |
-| Header | `Accept: application/vnd.api+json;version=1` | Clean URLs | Hidden version |
-| Query Param | `/users?version=1` | Easy to test | Pollutes query string |
-
-### Recommended: URL Path Versioning
-
-```typescript
-// Express routing
-import v1Routes from './routes/v1';
-import v2Routes from './routes/v2';
-
-app.use('/api/v1', v1Routes);
-app.use('/api/v2', v2Routes);
-```
-
-### Deprecation Strategy
-
-```typescript
-// Add deprecation headers
-app.use('/api/v1', (req, res, next) => {
-  res.set('Deprecation', 'true');
-  res.set('Sunset', 'Sat, 01 Jun 2025 00:00:00 GMT');
-  res.set('Link', '</api/v2>; rel="successor-version"');
-  next();
-}, v1Routes);
-```
-
-### Breaking vs Non-Breaking Changes
-
-**Non-breaking (safe):**
-- Adding new endpoints
-- Adding optional fields
-- Adding new enum values at end
-
-**Breaking (requires new version):**
-- Removing endpoints or fields
-- Renaming fields
-- Changing field types
-- Changing required/optional status
-
----
-
-## 4. Error Handling Patterns
-
-### Standard Error Response Format
-
-```json
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Request validation failed",
-    "details": [
-      {
-        "field": "email",
-        "code": "INVALID_FORMAT",
-        "message": "Must be a valid email address"
-      },
-      {
-        "field": "age",
-        "code": "OUT_OF_RANGE",
-        "message": "Must be between 18 and 120"
-      }
-    ],
-    "documentation_url": "https://api.example.com/docs/errors#validation"
-  },
-  "meta": {
-    "request_id": "req_abc123",
-    "timestamp": "2024-01-15T10:30:00Z"
-  }
-}
-```
-
-### Error Codes by Category
-
-```typescript
-// Client errors (4xx)
-const ClientErrors = {
-  VALIDATION_ERROR: 400,
-  INVALID_JSON: 400,
-  AUTHENTICATION_REQUIRED: 401,
-  INVALID_TOKEN: 401,
-  TOKEN_EXPIRED: 401,
-  PERMISSION_DENIED: 403,
-  RESOURCE_NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  RATE_LIMIT_EXCEEDED: 429,
-};
-
-// Server errors (5xx)
-const ServerErrors = {
-  INTERNAL_ERROR: 500,
-  DATABASE_ERROR: 500,
-  EXTERNAL_SERVICE_ERROR: 502,
-  SERVICE_UNAVAILABLE: 503,
-};
-```
-
-### Error Handler Implementation
-
-```typescript
-// Express error handler
-interface ApiError extends Error {
-  code: string;
-  statusCode: number;
-  details?: Array<{ field: string; message: string }>;
-}
-
-const errorHandler: ErrorRequestHandler = (err: ApiError, req, res, next) => {
-  const statusCode = err.statusCode || 500;
-  const code = err.code || 'INTERNAL_ERROR';
-
-  // Log server errors
-  if (statusCode >= 500) {
-    logger.error({ err, requestId: req.id }, 'Server error');
-  }
-
-  res.status(statusCode).json({
-    error: {
-      code,
-      message: statusCode >= 500 ? 'An unexpected error occurred' : err.message,
-      details: err.details,
-      ...(process.env.NODE_ENV === 'development' && { stack: err.stack }),
-    },
-    meta: {
-      request_id: req.id,
-      timestamp: new Date().toISOString(),
-    },
-  });
-};
-```
-
----
-
-## 5. Pagination Patterns
-
-### Offset-Based Pagination
-
-```
-GET /users?limit=20&offset=40
-
-Response:
-{
-  "data": [...],
-  "pagination": {
-    "total": 1250,
-    "limit": 20,
-    "offset": 40,
-    "has_more": true
-  }
-}
-```
-
-**Pros:** Simple, supports random access
-**Cons:** Inconsistent with concurrent inserts/deletes
-
-### Cursor-Based Pagination
-
-```
-GET /users?limit=20&cursor=eyJpZCI6MTIzfQ==
-
-Response:
-{
-  "data": [...],
-  "pagination": {
-    "limit": 20,
-    "next_cursor": "eyJpZCI6MTQzfQ==",
-    "prev_cursor": "eyJpZCI6MTIzfQ==",
-    "has_more": true
-  }
-}
-```
-
-**Pros:** Consistent with real-time data, efficient
-**Cons:** No random access, cursor encoding required
-
-### Implementation Example
-
-```typescript
-// Cursor-based pagination
-interface CursorPagination {
-  limit: number;
-  cursor?: string;
-  direction?: 'forward' | 'backward';
-}
-
-async function paginatedQuery<T>(
-  query: QueryBuilder,
-  { limit, cursor, direction = 'forward' }: CursorPagination
-): Promise<{ data: T[]; nextCursor?: string; hasMore: boolean }> {
-  // Decode cursor
-  const decoded = cursor ? JSON.parse(Buffer.from(cursor, 'base64').toString()) : null;
-
-  // Apply cursor condition
-  if (decoded) {
-    query = direction === 'forward'
-      ? query.where('id', '>', decoded.id)
-      : query.where('id', '<', decoded.id);
-  }
-
-  // Fetch one extra to check if more exist
-  const results = await query.limit(limit + 1).orderBy('id', direction === 'forward' ? 'asc' : 'desc');
-
-  const hasMore = results.length > limit;
-  const data = hasMore ? results.slice(0, -1) : results;
-
-  // Encode next cursor
-  const nextCursor = hasMore
-    ? Buffer.from(JSON.stringify({ id: data[data.length - 1].id })).toString('base64')
-    : undefined;
-
-  return { data, nextCursor, hasMore };
-}
-```
-
----
-
-## 6. Authentication Patterns
-
-### JWT Authentication Flow
-
-```
-┌──────────┐      1. Login        ┌──────────┐
-│  Client  │ ──────────────────▶  │  Server  │
-└──────────┘                      └──────────┘
-                                       │
-     2. Return JWT                     │
-◀────────────────────────────────────────
-     {access_token, refresh_token}     │
-                                       │
-     3. API Request                    │
-───────────────────────────────────────▶
-     Authorization: Bearer {token}     │
-                                       │
-     4. Validate & Respond             │
-◀────────────────────────────────────────
-```
-
-### JWT Implementation
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-interface TokenPayload {
-  userId: string;
-  email: string;
-  roles: string[];
-}
-
-// Generate tokens
-function generateTokens(user: User): { accessToken: string; refreshToken: string } {
-  const payload: TokenPayload = {
-    userId: user.id,
-    email: user.email,
-    roles: user.roles,
-  };
-
-  const accessToken = jwt.sign(payload, process.env.JWT_SECRET!, {
-    expiresIn: '15m',
-    algorithm: 'RS256',
-  });
-
-  const refreshToken = jwt.sign(
-    { userId: user.id, tokenVersion: user.tokenVersion },
-    process.env.JWT_REFRESH_SECRET!,
-    { expiresIn: '7d', algorithm: 'RS256' }
-  );
-
-  return { accessToken, refreshToken };
-}
-
-// Middleware
-const authenticate: RequestHandler = async (req, res, next) => {
-  const authHeader = req.headers.authorization;
-  if (!authHeader?.startsWith('Bearer ')) {
-    return res.status(401).json({ error: { code: 'AUTHENTICATION_REQUIRED' } });
-  }
-
-  try {
-    const token = authHeader.slice(7);
-    const payload = jwt.verify(token, process.env.JWT_SECRET!) as TokenPayload;
-    req.user = payload;
-    next();
-  } catch (err) {
-    if (err instanceof jwt.TokenExpiredError) {
-      return res.status(401).json({ error: { code: 'TOKEN_EXPIRED' } });
-    }
-    return res.status(401).json({ error: { code: 'INVALID_TOKEN' } });
-  }
-};
-```
-
-### API Key Authentication (Service-to-Service)
-
-```typescript
-// API key middleware
-const apiKeyAuth: RequestHandler = async (req, res, next) => {
-  const apiKey = req.headers['x-api-key'] as string;
-
-  if (!apiKey) {
-    return res.status(401).json({ error: { code: 'API_KEY_REQUIRED' } });
-  }
-
-  // Hash and lookup (never store plain API keys)
-  const hashedKey = crypto.createHash('sha256').update(apiKey).digest('hex');
-  const client = await db.apiClients.findByHashedKey(hashedKey);
-
-  if (!client || !client.isActive) {
-    return res.status(401).json({ error: { code: 'INVALID_API_KEY' } });
-  }
-
-  req.apiClient = client;
-  next();
-};
-```
-
----
-
-## 7. Rate Limiting Design
-
-### Rate Limit Headers
-
-```
-HTTP/1.1 200 OK
-X-RateLimit-Limit: 100
-X-RateLimit-Remaining: 95
-X-RateLimit-Reset: 1705312800
-Retry-After: 60
-```
-
-### Tiered Rate Limits
-
-```typescript
-const rateLimits = {
-  anonymous: { requests: 60, window: '1m' },
-  authenticated: { requests: 1000, window: '1h' },
-  premium: { requests: 10000, window: '1h' },
-};
-
-// Implementation with Redis
-import { RateLimiterRedis } from 'rate-limiter-flexible';
-
-const createRateLimiter = (tier: keyof typeof rateLimits) => {
-  const config = rateLimits[tier];
-  return new RateLimiterRedis({
-    storeClient: redisClient,
-    keyPrefix: `ratelimit:${tier}`,
-    points: config.requests,
-    duration: parseDuration(config.window),
-  });
-};
-```
-
-### Rate Limit Response
-
-```json
-{
-  "error": {
-    "code": "RATE_LIMIT_EXCEEDED",
-    "message": "Too many requests",
-    "details": {
-      "limit": 100,
-      "window": "1 minute",
-      "retry_after": 45
-    }
-  }
-}
-```
-
----
-
-## 8. Idempotency Patterns
-
-### Idempotency Key Header
-
-```
-POST /payments
-Idempotency-Key: payment_abc123_attempt1
-Content-Type: application/json
-
-{
-  "amount": 1000,
-  "currency": "USD"
-}
-```
-
-### Implementation
-
-```typescript
-const idempotencyMiddleware: RequestHandler = async (req, res, next) => {
-  const idempotencyKey = req.headers['idempotency-key'] as string;
-
-  if (!idempotencyKey) {
-    return next(); // Optional for some endpoints
-  }
-
-  // Check for existing response
-  const cached = await redis.get(`idempotency:${idempotencyKey}`);
-  if (cached) {
-    const { statusCode, body } = JSON.parse(cached);
-    return res.status(statusCode).json(body);
-  }
-
-  // Store response after processing
-  const originalJson = res.json.bind(res);
-  res.json = (body: any) => {
-    redis.setex(
-      `idempotency:${idempotencyKey}`,
-      86400, // 24 hours
-      JSON.stringify({ statusCode: res.statusCode, body })
-    );
-    return originalJson(body);
-  };
-
-  next();
-};
-```
-
----
-
-## Quick Reference: HTTP Methods
-
-| Method | Idempotent | Safe | Cacheable | Request Body |
-|--------|------------|------|-----------|--------------|
-| GET | Yes | Yes | Yes | No |
-| HEAD | Yes | Yes | Yes | No |
-| POST | No | No | Conditional | Yes |
-| PUT | Yes | No | No | Yes |
-| PATCH | No | No | No | Yes |
-| DELETE | Yes | No | No | Optional |
-| OPTIONS | Yes | Yes | No | No |
diff --git a/.claude/skills/senior-backend/references/backend_security_practices.md b/.claude/skills/senior-backend/references/backend_security_practices.md
deleted file mode 100644
index e07c417..0000000
--- a/.claude/skills/senior-backend/references/backend_security_practices.md
+++ /dev/null
@@ -1,1075 +0,0 @@
-# Backend Security Practices
-
-Security patterns and OWASP Top 10 mitigations for Node.js/Express applications.
-
-## Guide Index
-
-1. [OWASP Top 10 Mitigations](#1-owasp-top-10-mitigations)
-2. [Input Validation](#2-input-validation)
-3. [SQL Injection Prevention](#3-sql-injection-prevention)
-4. [XSS Prevention](#4-xss-prevention)
-5. [Authentication Security](#5-authentication-security)
-6. [Authorization Patterns](#6-authorization-patterns)
-7. [Security Headers](#7-security-headers)
-8. [Secrets Management](#8-secrets-management)
-9. [Logging and Monitoring](#9-logging-and-monitoring)
-
----
-
-## 1. OWASP Top 10 Mitigations
-
-### A01: Broken Access Control
-
-```typescript
-// BAD: Direct object reference
-app.get('/users/:id/profile', async (req, res) => {
-  const user = await db.users.findById(req.params.id);
-  res.json(user); // Anyone can access any user!
-});
-
-// GOOD: Verify ownership
-app.get('/users/:id/profile', authenticate, async (req, res) => {
-  const userId = req.params.id;
-
-  // Verify user can only access their own data
-  if (req.user.id !== userId && !req.user.roles.includes('admin')) {
-    return res.status(403).json({ error: { code: 'FORBIDDEN' } });
-  }
-
-  const user = await db.users.findById(userId);
-  res.json(user);
-});
-```
-
-### A02: Cryptographic Failures
-
-```typescript
-// BAD: Weak hashing
-const hash = crypto.createHash('md5').update(password).digest('hex');
-
-// GOOD: bcrypt with appropriate cost factor
-import bcrypt from 'bcrypt';
-
-const SALT_ROUNDS = 12; // Adjust based on hardware
-
-async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-async function verifyPassword(password: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(password, hash);
-}
-```
-
-### A03: Injection
-
-```typescript
-// BAD: String concatenation in SQL
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-
-// GOOD: Parameterized queries
-const result = await db.query(
-  'SELECT * FROM users WHERE email = $1',
-  [email]
-);
-```
-
-### A04: Insecure Design
-
-```typescript
-// BAD: No rate limiting on sensitive operations
-app.post('/forgot-password', async (req, res) => {
-  await sendResetEmail(req.body.email);
-  res.json({ message: 'If email exists, reset link sent' });
-});
-
-// GOOD: Rate limit + consistent response time
-import rateLimit from 'express-rate-limit';
-
-const passwordResetLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 3, // 3 attempts per 15 minutes
-  skipSuccessfulRequests: false,
-});
-
-app.post('/forgot-password', passwordResetLimiter, async (req, res) => {
-  const startTime = Date.now();
-
-  try {
-    const user = await db.users.findByEmail(req.body.email);
-    if (user) {
-      await sendResetEmail(user.email);
-    }
-  } catch (err) {
-    logger.error(err);
-  }
-
-  // Consistent response time prevents timing attacks
-  const elapsed = Date.now() - startTime;
-  const minDelay = 500;
-  if (elapsed < minDelay) {
-    await sleep(minDelay - elapsed);
-  }
-
-  // Same response regardless of email existence
-  res.json({ message: 'If email exists, reset link sent' });
-});
-```
-
-### A05: Security Misconfiguration
-
-```typescript
-// BAD: Detailed errors in production
-app.use((err, req, res, next) => {
-  res.status(500).json({
-    error: err.message,
-    stack: err.stack, // Exposes internals!
-  });
-});
-
-// GOOD: Environment-aware error handling
-app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
-  const requestId = req.id;
-
-  // Always log full error internally
-  logger.error({ err, requestId }, 'Unhandled error');
-
-  // Return safe response
-  res.status(500).json({
-    error: {
-      code: 'INTERNAL_ERROR',
-      message: process.env.NODE_ENV === 'development'
-        ? err.message
-        : 'An unexpected error occurred',
-      requestId,
-    },
-  });
-});
-```
-
-### A06: Vulnerable Components
-
-```bash
-# Check for vulnerabilities
-npm audit
-
-# Fix automatically where possible
-npm audit fix
-
-# Check specific package
-npm audit --package-lock-only
-
-# Use Snyk for deeper analysis
-npx snyk test
-```
-
-```typescript
-// Automated dependency updates (package.json)
-{
-  "scripts": {
-    "security:audit": "npm audit --audit-level=high",
-    "security:check": "snyk test",
-    "preinstall": "npm audit"
-  }
-}
-```
-
-### A07: Authentication Failures
-
-```typescript
-// BAD: Weak session management
-app.post('/login', async (req, res) => {
-  const user = await authenticate(req.body);
-  req.session.userId = user.id; // Session fixation risk
-  res.json({ success: true });
-});
-
-// GOOD: Regenerate session on authentication
-app.post('/login', async (req, res) => {
-  const user = await authenticate(req.body);
-
-  // Regenerate session to prevent fixation
-  req.session.regenerate((err) => {
-    if (err) return next(err);
-
-    req.session.userId = user.id;
-    req.session.createdAt = Date.now();
-
-    req.session.save((err) => {
-      if (err) return next(err);
-      res.json({ success: true });
-    });
-  });
-});
-```
-
-### A08: Software and Data Integrity Failures
-
-```typescript
-// Verify webhook signatures (e.g., Stripe)
-import Stripe from 'stripe';
-
-app.post('/webhooks/stripe',
-  express.raw({ type: 'application/json' }),
-  async (req, res) => {
-    const sig = req.headers['stripe-signature'] as string;
-    const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET!;
-
-    let event: Stripe.Event;
-
-    try {
-      event = stripe.webhooks.constructEvent(
-        req.body,
-        sig,
-        endpointSecret
-      );
-    } catch (err) {
-      logger.warn({ err }, 'Webhook signature verification failed');
-      return res.status(400).json({ error: 'Invalid signature' });
-    }
-
-    // Process verified event
-    await handleStripeEvent(event);
-    res.json({ received: true });
-  }
-);
-```
-
-### A09: Security Logging Failures
-
-```typescript
-// Comprehensive security logging
-import pino from 'pino';
-
-const logger = pino({
-  level: process.env.LOG_LEVEL || 'info',
-  redact: ['req.headers.authorization', 'req.body.password'], // Redact sensitive
-});
-
-// Log security events
-function logSecurityEvent(event: {
-  type: 'LOGIN_SUCCESS' | 'LOGIN_FAILURE' | 'ACCESS_DENIED' | 'SUSPICIOUS_ACTIVITY';
-  userId?: string;
-  ip: string;
-  userAgent: string;
-  details?: Record<string, unknown>;
-}) {
-  logger.info({
-    security: true,
-    ...event,
-    timestamp: new Date().toISOString(),
-  }, `Security event: ${event.type}`);
-}
-
-// Usage
-app.post('/login', async (req, res) => {
-  try {
-    const user = await authenticate(req.body);
-    logSecurityEvent({
-      type: 'LOGIN_SUCCESS',
-      userId: user.id,
-      ip: req.ip,
-      userAgent: req.headers['user-agent'] || '',
-    });
-    // ...
-  } catch (err) {
-    logSecurityEvent({
-      type: 'LOGIN_FAILURE',
-      ip: req.ip,
-      userAgent: req.headers['user-agent'] || '',
-      details: { email: req.body.email },
-    });
-    // ...
-  }
-});
-```
-
-### A10: Server-Side Request Forgery (SSRF)
-
-```typescript
-// BAD: Unvalidated URL fetch
-app.post('/fetch-url', async (req, res) => {
-  const response = await fetch(req.body.url); // SSRF vulnerability!
-  res.json({ data: await response.text() });
-});
-
-// GOOD: URL allowlist and validation
-import { URL } from 'url';
-
-const ALLOWED_HOSTS = ['api.example.com', 'cdn.example.com'];
-
-function isAllowedUrl(urlString: string): boolean {
-  try {
-    const url = new URL(urlString);
-
-    // Block internal IPs
-    const blockedPatterns = [
-      /^localhost$/i,
-      /^127\./,
-      /^10\./,
-      /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
-      /^192\.168\./,
-      /^0\./,
-      /^169\.254\./,
-      /^\[::1\]$/,
-      /^metadata\.google\.internal$/,
-      /^169\.254\.169\.254$/,
-    ];
-
-    if (blockedPatterns.some(p => p.test(url.hostname))) {
-      return false;
-    }
-
-    // Only allow HTTPS
-    if (url.protocol !== 'https:') {
-      return false;
-    }
-
-    // Check allowlist
-    return ALLOWED_HOSTS.includes(url.hostname);
-  } catch {
-    return false;
-  }
-}
-
-app.post('/fetch-url', async (req, res) => {
-  const { url } = req.body;
-
-  if (!isAllowedUrl(url)) {
-    return res.status(400).json({ error: { code: 'INVALID_URL' } });
-  }
-
-  const response = await fetch(url, {
-    timeout: 5000,
-    follow: 0, // Don't follow redirects
-  });
-
-  res.json({ data: await response.text() });
-});
-```
-
----
-
-## 2. Input Validation
-
-### Schema Validation with Zod
-
-```typescript
-import { z } from 'zod';
-
-// Define schemas
-const CreateUserSchema = z.object({
-  email: z.string().email().max(255).toLowerCase(),
-  password: z.string()
-    .min(8, 'Password must be at least 8 characters')
-    .max(72, 'Password must be at most 72 characters') // bcrypt limit
-    .regex(/[A-Z]/, 'Password must contain uppercase letter')
-    .regex(/[a-z]/, 'Password must contain lowercase letter')
-    .regex(/[0-9]/, 'Password must contain number'),
-  name: z.string().min(1).max(100).trim(),
-  age: z.number().int().min(18).max(120).optional(),
-});
-
-const PaginationSchema = z.object({
-  limit: z.coerce.number().int().min(1).max(100).default(20),
-  offset: z.coerce.number().int().min(0).default(0),
-  sort: z.enum(['asc', 'desc']).default('desc'),
-});
-
-// Validation middleware
-function validate<T>(schema: z.ZodSchema<T>) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    const result = schema.safeParse(req.body);
-
-    if (!result.success) {
-      const details = result.error.errors.map(err => ({
-        field: err.path.join('.'),
-        code: err.code,
-        message: err.message,
-      }));
-
-      return res.status(400).json({
-        error: {
-          code: 'VALIDATION_ERROR',
-          message: 'Request validation failed',
-          details,
-        },
-      });
-    }
-
-    req.body = result.data;
-    next();
-  };
-}
-
-// Usage
-app.post('/users', validate(CreateUserSchema), async (req, res) => {
-  // req.body is now typed and validated
-  const user = await userService.create(req.body);
-  res.status(201).json(user);
-});
-```
-
-### Sanitization
-
-```typescript
-import DOMPurify from 'isomorphic-dompurify';
-import xss from 'xss';
-
-// HTML sanitization for rich text fields
-function sanitizeHtml(dirty: string): string {
-  return DOMPurify.sanitize(dirty, {
-    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],
-    ALLOWED_ATTR: ['href'],
-  });
-}
-
-// Plain text sanitization (strip all HTML)
-function sanitizePlainText(dirty: string): string {
-  return xss(dirty, {
-    whiteList: {},
-    stripIgnoreTag: true,
-    stripIgnoreTagBody: ['script'],
-  });
-}
-
-// File path sanitization
-import path from 'path';
-
-function sanitizePath(userPath: string, baseDir: string): string | null {
-  const resolved = path.resolve(baseDir, userPath);
-
-  // Prevent directory traversal
-  if (!resolved.startsWith(baseDir)) {
-    return null;
-  }
-
-  return resolved;
-}
-```
-
----
-
-## 3. SQL Injection Prevention
-
-### Parameterized Queries
-
-```typescript
-// BAD: String interpolation
-const email = "'; DROP TABLE users; --";
-db.query(`SELECT * FROM users WHERE email = '${email}'`);
-
-// GOOD: Parameterized query (pg)
-const result = await db.query(
-  'SELECT * FROM users WHERE email = $1',
-  [email]
-);
-
-// GOOD: Parameterized query (mysql2)
-const [rows] = await connection.execute(
-  'SELECT * FROM users WHERE email = ?',
-  [email]
-);
-```
-
-### Query Builders
-
-```typescript
-// Using Knex.js
-const users = await knex('users')
-  .where('email', email) // Automatically parameterized
-  .andWhere('status', 'active')
-  .select('id', 'name', 'email');
-
-// Dynamic WHERE with safe column names
-const ALLOWED_COLUMNS = ['name', 'email', 'created_at'] as const;
-
-function buildUserQuery(filters: Record<string, string>) {
-  let query = knex('users').select('id', 'name', 'email');
-
-  for (const [column, value] of Object.entries(filters)) {
-    // Validate column name against allowlist
-    if (ALLOWED_COLUMNS.includes(column as any)) {
-      query = query.where(column, value);
-    }
-  }
-
-  return query;
-}
-```
-
-### ORM Safety
-
-```typescript
-// Prisma (safe by default)
-const user = await prisma.user.findUnique({
-  where: { email }, // Automatically escaped
-});
-
-// TypeORM (safe by default)
-const user = await userRepository.findOne({
-  where: { email }, // Automatically escaped
-});
-
-// DANGER: Raw queries still require parameterization
-// BAD
-await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE email = '${email}'`);
-
-// GOOD
-await prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;
-```
-
----
-
-## 4. XSS Prevention
-
-### Output Encoding
-
-```typescript
-// Server-side template rendering (EJS)
-// In template: <%= userInput %> (escaped)
-// NOT: <%- userInput %> (raw, dangerous)
-
-// Manual HTML encoding
-function escapeHtml(str: string): string {
-  return str
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
-
-// JSON response (automatically safe in modern frameworks)
-res.json({ message: userInput }); // JSON.stringify escapes by default
-```
-
-### Content Security Policy
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet.contentSecurityPolicy({
-  directives: {
-    defaultSrc: ["'self'"],
-    scriptSrc: ["'self'", "'strict-dynamic'"],
-    styleSrc: ["'self'", "'unsafe-inline'"], // Consider using nonces
-    imgSrc: ["'self'", "data:", "https:"],
-    fontSrc: ["'self'"],
-    objectSrc: ["'none'"],
-    frameAncestors: ["'none'"],
-    baseUri: ["'self'"],
-    formAction: ["'self'"],
-    upgradeInsecureRequests: [],
-  },
-}));
-```
-
-### API Response Safety
-
-```typescript
-// Set correct Content-Type for JSON APIs
-app.use((req, res, next) => {
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  next();
-});
-
-// Disable JSONP (if not needed)
-// Don't implement callback parameter handling
-
-// Safe JSON response
-res.json({
-  data: sanitizedData,
-  // Never reflect raw user input
-});
-```
-
----
-
-## 5. Authentication Security
-
-### Password Storage
-
-```typescript
-import bcrypt from 'bcrypt';
-import { randomBytes } from 'crypto';
-
-const SALT_ROUNDS = 12;
-
-async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-async function verifyPassword(password: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(password, hash);
-}
-
-// For password reset tokens
-function generateSecureToken(): string {
-  return randomBytes(32).toString('hex');
-}
-
-// Token expiration (store in DB)
-interface PasswordResetToken {
-  token: string; // Hashed
-  userId: string;
-  expiresAt: Date; // 1 hour from creation
-}
-```
-
-### JWT Best Practices
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-// Use asymmetric keys in production
-const PRIVATE_KEY = process.env.JWT_PRIVATE_KEY!;
-const PUBLIC_KEY = process.env.JWT_PUBLIC_KEY!;
-
-interface AccessTokenPayload {
-  sub: string; // User ID
-  email: string;
-  roles: string[];
-  iat: number;
-  exp: number;
-}
-
-function generateAccessToken(user: User): string {
-  const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {
-    sub: user.id,
-    email: user.email,
-    roles: user.roles,
-  };
-
-  return jwt.sign(payload, PRIVATE_KEY, {
-    algorithm: 'RS256',
-    expiresIn: '15m',
-    issuer: 'api.example.com',
-    audience: 'example.com',
-  });
-}
-
-function verifyAccessToken(token: string): AccessTokenPayload {
-  return jwt.verify(token, PUBLIC_KEY, {
-    algorithms: ['RS256'],
-    issuer: 'api.example.com',
-    audience: 'example.com',
-  }) as AccessTokenPayload;
-}
-
-// Refresh tokens should be stored in DB and rotated
-interface RefreshToken {
-  id: string;
-  token: string; // Hashed
-  userId: string;
-  expiresAt: Date;
-  family: string; // For rotation detection
-  isRevoked: boolean;
-}
-```
-
-### Session Management
-
-```typescript
-import session from 'express-session';
-import RedisStore from 'connect-redis';
-import { createClient } from 'redis';
-
-const redisClient = createClient({ url: process.env.REDIS_URL });
-
-app.use(session({
-  store: new RedisStore({ client: redisClient }),
-  name: 'sessionId', // Don't use default 'connect.sid'
-  secret: process.env.SESSION_SECRET!,
-  resave: false,
-  saveUninitialized: false,
-  cookie: {
-    secure: process.env.NODE_ENV === 'production',
-    httpOnly: true,
-    sameSite: 'strict',
-    maxAge: 24 * 60 * 60 * 1000, // 24 hours
-    domain: process.env.COOKIE_DOMAIN,
-  },
-}));
-
-// Regenerate session on privilege change
-async function elevateSession(req: Request): Promise<void> {
-  return new Promise((resolve, reject) => {
-    const userId = req.session.userId;
-    req.session.regenerate((err) => {
-      if (err) return reject(err);
-      req.session.userId = userId;
-      req.session.elevated = true;
-      req.session.elevatedAt = Date.now();
-      resolve();
-    });
-  });
-}
-```
-
----
-
-## 6. Authorization Patterns
-
-### Role-Based Access Control (RBAC)
-
-```typescript
-type Role = 'user' | 'moderator' | 'admin';
-type Permission = 'read:users' | 'write:users' | 'delete:users' | 'read:admin';
-
-const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
-  user: ['read:users'],
-  moderator: ['read:users', 'write:users'],
-  admin: ['read:users', 'write:users', 'delete:users', 'read:admin'],
-};
-
-function hasPermission(userRoles: Role[], required: Permission): boolean {
-  return userRoles.some(role =>
-    ROLE_PERMISSIONS[role]?.includes(required)
-  );
-}
-
-// Middleware
-function requirePermission(permission: Permission) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    if (!hasPermission(req.user.roles, permission)) {
-      return res.status(403).json({
-        error: { code: 'FORBIDDEN', message: 'Insufficient permissions' },
-      });
-    }
-    next();
-  };
-}
-
-// Usage
-app.delete('/users/:id',
-  authenticate,
-  requirePermission('delete:users'),
-  deleteUserHandler
-);
-```
-
-### Attribute-Based Access Control (ABAC)
-
-```typescript
-interface AccessContext {
-  user: { id: string; roles: string[]; department: string };
-  resource: { ownerId: string; department: string; sensitivity: string };
-  action: 'read' | 'write' | 'delete';
-  environment: { time: Date; ip: string };
-}
-
-interface Policy {
-  name: string;
-  condition: (ctx: AccessContext) => boolean;
-}
-
-const policies: Policy[] = [
-  {
-    name: 'owner-full-access',
-    condition: (ctx) => ctx.resource.ownerId === ctx.user.id,
-  },
-  {
-    name: 'same-department-read',
-    condition: (ctx) =>
-      ctx.action === 'read' &&
-      ctx.resource.department === ctx.user.department,
-  },
-  {
-    name: 'admin-override',
-    condition: (ctx) => ctx.user.roles.includes('admin'),
-  },
-  {
-    name: 'no-sensitive-outside-hours',
-    condition: (ctx) => {
-      const hour = ctx.environment.time.getHours();
-      return ctx.resource.sensitivity !== 'high' || (hour >= 9 && hour <= 17);
-    },
-  },
-];
-
-function evaluateAccess(ctx: AccessContext): boolean {
-  return policies.some(policy => policy.condition(ctx));
-}
-```
-
----
-
-## 7. Security Headers
-
-### Complete Helmet Configuration
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet({
-  // Content Security Policy
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "https://api.example.com"],
-      fontSrc: ["'self'"],
-      objectSrc: ["'none'"],
-      mediaSrc: ["'none'"],
-      frameSrc: ["'none'"],
-    },
-  },
-  // Strict Transport Security
-  hsts: {
-    maxAge: 31536000,
-    includeSubDomains: true,
-    preload: true,
-  },
-  // Prevent clickjacking
-  frameguard: { action: 'deny' },
-  // Prevent MIME sniffing
-  noSniff: true,
-  // XSS filter (legacy browsers)
-  xssFilter: true,
-  // Hide X-Powered-By
-  hidePoweredBy: true,
-  // Referrer policy
-  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-  // Cross-origin policies
-  crossOriginEmbedderPolicy: false, // Enable if using SharedArrayBuffer
-  crossOriginOpenerPolicy: { policy: 'same-origin' },
-  crossOriginResourcePolicy: { policy: 'same-origin' },
-}));
-
-// CORS configuration
-import cors from 'cors';
-
-app.use(cors({
-  origin: ['https://example.com', 'https://app.example.com'],
-  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-  credentials: true,
-  maxAge: 86400, // 24 hours
-}));
-```
-
-### Header Reference
-
-| Header | Purpose | Value |
-|--------|---------|-------|
-| `Strict-Transport-Security` | Force HTTPS | `max-age=31536000; includeSubDomains; preload` |
-| `Content-Security-Policy` | Prevent XSS | See above |
-| `X-Content-Type-Options` | Prevent MIME sniffing | `nosniff` |
-| `X-Frame-Options` | Prevent clickjacking | `DENY` |
-| `Referrer-Policy` | Control referrer info | `strict-origin-when-cross-origin` |
-| `Permissions-Policy` | Feature restrictions | `geolocation=(), microphone=()` |
-
----
-
-## 8. Secrets Management
-
-### Environment Variables
-
-```typescript
-// config/secrets.ts
-import { z } from 'zod';
-
-const SecretsSchema = z.object({
-  DATABASE_URL: z.string().url(),
-  JWT_SECRET: z.string().min(32),
-  JWT_PRIVATE_KEY: z.string(),
-  JWT_PUBLIC_KEY: z.string(),
-  REDIS_URL: z.string().url(),
-  STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
-  STRIPE_WEBHOOK_SECRET: z.string().startsWith('whsec_'),
-});
-
-// Validate on startup
-export const secrets = SecretsSchema.parse(process.env);
-
-// NEVER log secrets
-console.log('Config loaded:', {
-  database: secrets.DATABASE_URL.replace(/\/\/.*@/, '//***@'),
-  redis: 'configured',
-  stripe: 'configured',
-});
-```
-
-### Secret Rotation
-
-```typescript
-// Support multiple keys during rotation
-const JWT_SECRETS = [
-  process.env.JWT_SECRET_CURRENT!,
-  process.env.JWT_SECRET_PREVIOUS!, // Keep for grace period
-].filter(Boolean);
-
-function verifyTokenWithRotation(token: string): TokenPayload | null {
-  for (const secret of JWT_SECRETS) {
-    try {
-      return jwt.verify(token, secret) as TokenPayload;
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-```
-
-### Vault Integration
-
-```typescript
-import Vault from 'node-vault';
-
-const vault = Vault({
-  endpoint: process.env.VAULT_ADDR,
-  token: process.env.VAULT_TOKEN,
-});
-
-async function getSecret(path: string): Promise<string> {
-  const result = await vault.read(`secret/data/${path}`);
-  return result.data.data.value;
-}
-
-// Cache secrets with TTL
-const secretsCache = new Map<string, { value: string; expiresAt: number }>();
-const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-
-async function getCachedSecret(path: string): Promise<string> {
-  const cached = secretsCache.get(path);
-  if (cached && cached.expiresAt > Date.now()) {
-    return cached.value;
-  }
-
-  const value = await getSecret(path);
-  secretsCache.set(path, { value, expiresAt: Date.now() + CACHE_TTL });
-  return value;
-}
-```
-
----
-
-## 9. Logging and Monitoring
-
-### Security Event Logging
-
-```typescript
-import pino from 'pino';
-
-const logger = pino({
-  level: 'info',
-  redact: {
-    paths: [
-      'req.headers.authorization',
-      'req.headers.cookie',
-      'req.body.password',
-      'req.body.token',
-      '*.password',
-      '*.secret',
-      '*.apiKey',
-    ],
-    censor: '[REDACTED]',
-  },
-});
-
-// Security event types
-type SecurityEventType =
-  | 'AUTH_SUCCESS'
-  | 'AUTH_FAILURE'
-  | 'AUTH_LOCKOUT'
-  | 'PASSWORD_CHANGED'
-  | 'PASSWORD_RESET_REQUEST'
-  | 'PERMISSION_DENIED'
-  | 'RATE_LIMIT_EXCEEDED'
-  | 'SUSPICIOUS_ACTIVITY'
-  | 'TOKEN_REVOKED';
-
-interface SecurityEvent {
-  type: SecurityEventType;
-  userId?: string;
-  ip: string;
-  userAgent: string;
-  path: string;
-  details?: Record<string, unknown>;
-}
-
-function logSecurityEvent(event: SecurityEvent): void {
-  logger.info({
-    security: true,
-    ...event,
-    timestamp: new Date().toISOString(),
-  }, `Security: ${event.type}`);
-}
-```
-
-### Request Logging
-
-```typescript
-import pinoHttp from 'pino-http';
-
-app.use(pinoHttp({
-  logger,
-  genReqId: (req) => req.headers['x-request-id'] || crypto.randomUUID(),
-  serializers: {
-    req: (req) => ({
-      id: req.id,
-      method: req.method,
-      url: req.url,
-      remoteAddress: req.remoteAddress,
-      // Don't log headers by default (may contain sensitive data)
-    }),
-    res: (res) => ({
-      statusCode: res.statusCode,
-    }),
-  },
-  customLogLevel: (req, res, err) => {
-    if (res.statusCode >= 500 || err) return 'error';
-    if (res.statusCode >= 400) return 'warn';
-    return 'info';
-  },
-}));
-```
-
-### Alerting Thresholds
-
-| Metric | Warning | Critical |
-|--------|---------|----------|
-| Failed logins per IP (15 min) | > 5 | > 10 |
-| Failed logins per account (1 hour) | > 3 | > 5 |
-| 403 responses per IP (5 min) | > 10 | > 50 |
-| 500 errors (5 min) | > 5 | > 20 |
-| Request rate per IP (1 min) | > 100 | > 500 |
-
----
-
-## Quick Reference: Security Checklist
-
-### Authentication
-- [ ] bcrypt with cost >= 12 for password hashing
-- [ ] JWT with RS256, short expiry (15-30 min)
-- [ ] Refresh token rotation with family detection
-- [ ] Session regeneration on login
-- [ ] Secure cookie flags (httpOnly, secure, sameSite)
-
-### Input Validation
-- [ ] Schema validation on all inputs (Zod)
-- [ ] Parameterized queries (never string concat)
-- [ ] File path sanitization
-- [ ] Content-Type validation
-
-### Headers
-- [ ] Strict-Transport-Security
-- [ ] Content-Security-Policy
-- [ ] X-Content-Type-Options: nosniff
-- [ ] X-Frame-Options: DENY
-- [ ] CORS with specific origins
-
-### Logging
-- [ ] Redact sensitive fields
-- [ ] Log security events
-- [ ] Include request IDs
-- [ ] Alert on anomalies
-
-### Dependencies
-- [ ] npm audit in CI
-- [ ] Automated dependency updates
-- [ ] Lock file committed
diff --git a/.claude/skills/senior-backend/references/database_optimization_guide.md b/.claude/skills/senior-backend/references/database_optimization_guide.md
deleted file mode 100644
index 03412ed..0000000
--- a/.claude/skills/senior-backend/references/database_optimization_guide.md
+++ /dev/null
@@ -1,593 +0,0 @@
-# Database Optimization Guide
-
-Practical strategies for PostgreSQL query optimization, indexing, and performance tuning.
-
-## Guide Index
-
-1. [Query Analysis with EXPLAIN](#1-query-analysis-with-explain)
-2. [Indexing Strategies](#2-indexing-strategies)
-3. [N+1 Query Problem](#3-n1-query-problem)
-4. [Connection Pooling](#4-connection-pooling)
-5. [Query Optimization Patterns](#5-query-optimization-patterns)
-6. [Database Migrations](#6-database-migrations)
-7. [Monitoring and Alerting](#7-monitoring-and-alerting)
-
----
-
-## 1. Query Analysis with EXPLAIN
-
-### Basic EXPLAIN Usage
-
-```sql
--- Show query plan
-EXPLAIN SELECT * FROM orders WHERE user_id = 123;
-
--- Show plan with actual execution times
-EXPLAIN ANALYZE SELECT * FROM orders WHERE user_id = 123;
-
--- Show buffers and I/O statistics
-EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT)
-SELECT * FROM orders WHERE user_id = 123;
-```
-
-### Reading EXPLAIN Output
-
-```
-                                    QUERY PLAN
----------------------------------------------------------------------------
- Index Scan using idx_orders_user_id on orders  (cost=0.43..8.45 rows=10 width=120)
-   Index Cond: (user_id = 123)
-   Buffers: shared hit=3
- Planning Time: 0.152 ms
- Execution Time: 0.089 ms
-```
-
-**Key metrics:**
-- `cost`: Estimated cost (startup..total)
-- `rows`: Estimated row count
-- `width`: Average row size in bytes
-- `actual time`: Real execution time (with ANALYZE)
-- `Buffers: shared hit`: Pages read from cache
-
-### Scan Types (Best to Worst)
-
-| Scan Type | Description | Performance |
-|-----------|-------------|-------------|
-| Index Only Scan | Data from index alone | Best |
-| Index Scan | Index lookup + heap fetch | Good |
-| Bitmap Index Scan | Multiple index conditions | Good |
-| Index Scan + Filter | Index + row filtering | Okay |
-| Seq Scan (small table) | Full table scan | Okay |
-| Seq Scan (large table) | Full table scan | Bad |
-| Nested Loop (large) | O(n*m) join | Very Bad |
-
-### Warning Signs
-
-```sql
--- BAD: Sequential scan on large table
-Seq Scan on orders  (cost=0.00..1854231.00 rows=50000000 width=120)
-  Filter: (status = 'pending')
-  Rows Removed by Filter: 49500000
-
--- BAD: Nested loop with high iterations
-Nested Loop  (cost=0.43..2847593.20 rows=12500000 width=240)
-  ->  Seq Scan on users  (cost=0.00..1250.00 rows=50000 width=120)
-  ->  Index Scan on orders  (cost=0.43..45.73 rows=250 width=120)
-       Index Cond: (orders.user_id = users.id)
-```
-
----
-
-## 2. Indexing Strategies
-
-### Index Types
-
-```sql
--- B-tree (default, most common)
-CREATE INDEX idx_users_email ON users(email);
-
--- Hash (equality only, rarely better than B-tree)
-CREATE INDEX idx_users_id_hash ON users USING hash(id);
-
--- GIN (arrays, JSONB, full-text search)
-CREATE INDEX idx_products_tags ON products USING gin(tags);
-CREATE INDEX idx_users_data ON users USING gin(metadata jsonb_path_ops);
-
--- GiST (geometric, range types, full-text)
-CREATE INDEX idx_locations_point ON locations USING gist(coordinates);
-```
-
-### Composite Indexes
-
-```sql
--- Order matters! Column with = first, then range/sort
-CREATE INDEX idx_orders_user_status_date
-ON orders(user_id, status, created_at DESC);
-
--- This index supports:
--- WHERE user_id = ?
--- WHERE user_id = ? AND status = ?
--- WHERE user_id = ? AND status = ? ORDER BY created_at DESC
--- WHERE user_id = ? ORDER BY created_at DESC
-
--- This index does NOT efficiently support:
--- WHERE status = ? (user_id not in query)
--- WHERE created_at > ? (leftmost column not in query)
-```
-
-### Partial Indexes
-
-```sql
--- Index only active users (smaller, faster)
-CREATE INDEX idx_users_active_email
-ON users(email)
-WHERE status = 'active';
-
--- Index only recent orders
-CREATE INDEX idx_orders_recent
-ON orders(created_at DESC)
-WHERE created_at > CURRENT_DATE - INTERVAL '90 days';
-
--- Index only unprocessed items
-CREATE INDEX idx_queue_pending
-ON job_queue(priority DESC, created_at)
-WHERE processed_at IS NULL;
-```
-
-### Covering Indexes (Index-Only Scans)
-
-```sql
--- Include non-indexed columns to avoid heap lookup
-CREATE INDEX idx_users_email_covering
-ON users(email)
-INCLUDE (name, created_at);
-
--- Query can be satisfied from index alone
-SELECT name, created_at FROM users WHERE email = 'test@example.com';
--- Result: Index Only Scan
-```
-
-### Index Maintenance
-
-```sql
--- Check index usage
-SELECT
-    schemaname,
-    tablename,
-    indexname,
-    idx_scan,
-    idx_tup_read,
-    idx_tup_fetch,
-    pg_size_pretty(pg_relation_size(indexrelid)) as size
-FROM pg_stat_user_indexes
-ORDER BY idx_scan ASC;
-
--- Find unused indexes (candidates for removal)
-SELECT indexrelid::regclass as index,
-       relid::regclass as table,
-       pg_size_pretty(pg_relation_size(indexrelid)) as size
-FROM pg_stat_user_indexes
-WHERE idx_scan = 0
-  AND indexrelid NOT IN (SELECT conindid FROM pg_constraint);
-
--- Rebuild bloated indexes
-REINDEX INDEX CONCURRENTLY idx_orders_user_id;
-```
-
----
-
-## 3. N+1 Query Problem
-
-### The Problem
-
-```typescript
-// BAD: N+1 queries
-const users = await db.query('SELECT * FROM users LIMIT 100');
-
-for (const user of users) {
-  // This runs 100 times!
-  const orders = await db.query(
-    'SELECT * FROM orders WHERE user_id = $1',
-    [user.id]
-  );
-  user.orders = orders;
-}
-// Total queries: 1 + 100 = 101
-```
-
-### Solution 1: JOIN
-
-```typescript
-// GOOD: Single query with JOIN
-const usersWithOrders = await db.query(`
-  SELECT u.*, o.id as order_id, o.total, o.status
-  FROM users u
-  LEFT JOIN orders o ON o.user_id = u.id
-  LIMIT 100
-`);
-// Total queries: 1
-```
-
-### Solution 2: Batch Loading (DataLoader pattern)
-
-```typescript
-// GOOD: Two queries with batch loading
-const users = await db.query('SELECT * FROM users LIMIT 100');
-const userIds = users.map(u => u.id);
-
-const orders = await db.query(
-  'SELECT * FROM orders WHERE user_id = ANY($1)',
-  [userIds]
-);
-
-// Group orders by user_id
-const ordersByUser = groupBy(orders, 'user_id');
-users.forEach(user => {
-  user.orders = ordersByUser[user.id] || [];
-});
-// Total queries: 2
-```
-
-### Solution 3: ORM Eager Loading
-
-```typescript
-// Prisma
-const users = await prisma.user.findMany({
-  take: 100,
-  include: { orders: true }
-});
-
-// TypeORM
-const users = await userRepository.find({
-  take: 100,
-  relations: ['orders']
-});
-
-// Sequelize
-const users = await User.findAll({
-  limit: 100,
-  include: [{ model: Order }]
-});
-```
-
-### Detecting N+1 in Production
-
-```typescript
-// Query logging middleware
-let queryCount = 0;
-const originalQuery = db.query;
-
-db.query = async (...args) => {
-  queryCount++;
-  if (queryCount > 10) {
-    console.warn(`High query count: ${queryCount} in single request`);
-    console.trace();
-  }
-  return originalQuery.apply(db, args);
-};
-```
-
----
-
-## 4. Connection Pooling
-
-### Why Pooling Matters
-
-```
-Without pooling:
-Request → Create connection → Query → Close connection
-         (50-100ms overhead)
-
-With pooling:
-Request → Get connection from pool → Query → Return to pool
-         (0-1ms overhead)
-```
-
-### pg-pool Configuration
-
-```typescript
-import { Pool } from 'pg';
-
-const pool = new Pool({
-  host: process.env.DB_HOST,
-  port: 5432,
-  database: process.env.DB_NAME,
-  user: process.env.DB_USER,
-  password: process.env.DB_PASSWORD,
-
-  // Pool settings
-  min: 5,                    // Minimum connections
-  max: 20,                   // Maximum connections
-  idleTimeoutMillis: 30000,  // Close idle connections after 30s
-  connectionTimeoutMillis: 5000, // Fail if can't connect in 5s
-
-  // Statement timeout (cancel long queries)
-  statement_timeout: 30000,
-});
-
-// Health check
-pool.on('error', (err, client) => {
-  console.error('Unexpected pool error', err);
-});
-```
-
-### Pool Sizing Formula
-
-```
-Optimal connections = (CPU cores * 2) + effective_spindle_count
-
-For SSD with 4 cores:
-connections = (4 * 2) + 1 = 9
-
-For multiple app servers:
-connections_per_server = total_connections / num_servers
-```
-
-### PgBouncer for High Scale
-
-```ini
-# pgbouncer.ini
-[databases]
-mydb = host=localhost port=5432 dbname=mydb
-
-[pgbouncer]
-listen_port = 6432
-listen_addr = 0.0.0.0
-auth_type = md5
-auth_file = /etc/pgbouncer/userlist.txt
-pool_mode = transaction
-max_client_conn = 1000
-default_pool_size = 20
-reserve_pool_size = 5
-```
-
----
-
-## 5. Query Optimization Patterns
-
-### Pagination Optimization
-
-```sql
--- BAD: OFFSET is slow for large values
-SELECT * FROM orders ORDER BY created_at DESC LIMIT 20 OFFSET 10000;
--- Must scan 10,020 rows, discard 10,000
-
--- GOOD: Cursor-based pagination
-SELECT * FROM orders
-WHERE created_at < '2024-01-15T10:00:00Z'
-ORDER BY created_at DESC
-LIMIT 20;
--- Only scans 20 rows
-```
-
-### Batch Updates
-
-```sql
--- BAD: Individual updates
-UPDATE orders SET status = 'shipped' WHERE id = 1;
-UPDATE orders SET status = 'shipped' WHERE id = 2;
--- ...repeat 1000 times
-
--- GOOD: Batch update
-UPDATE orders
-SET status = 'shipped'
-WHERE id = ANY(ARRAY[1, 2, 3, ...1000]);
-
--- GOOD: Update from values
-UPDATE orders o
-SET status = v.new_status
-FROM (VALUES
-  (1, 'shipped'),
-  (2, 'delivered'),
-  (3, 'cancelled')
-) AS v(id, new_status)
-WHERE o.id = v.id;
-```
-
-### Avoiding SELECT *
-
-```sql
--- BAD: Fetches all columns including large text/blob
-SELECT * FROM articles WHERE published = true;
-
--- GOOD: Only fetch needed columns
-SELECT id, title, summary, author_id, published_at
-FROM articles
-WHERE published = true;
-```
-
-### Using EXISTS vs IN
-
-```sql
--- For checking existence, EXISTS is often faster
--- BAD
-SELECT * FROM users
-WHERE id IN (SELECT user_id FROM orders WHERE total > 1000);
-
--- GOOD (for large subquery results)
-SELECT * FROM users u
-WHERE EXISTS (
-  SELECT 1 FROM orders o
-  WHERE o.user_id = u.id AND o.total > 1000
-);
-```
-
-### Materialized Views for Complex Aggregations
-
-```sql
--- Create materialized view for expensive aggregations
-CREATE MATERIALIZED VIEW daily_sales_summary AS
-SELECT
-  date_trunc('day', created_at) as date,
-  product_id,
-  COUNT(*) as order_count,
-  SUM(quantity) as total_quantity,
-  SUM(total) as total_revenue
-FROM orders
-GROUP BY date_trunc('day', created_at), product_id;
-
--- Create index on materialized view
-CREATE INDEX idx_daily_sales_date ON daily_sales_summary(date);
-
--- Refresh periodically
-REFRESH MATERIALIZED VIEW CONCURRENTLY daily_sales_summary;
-```
-
----
-
-## 6. Database Migrations
-
-### Migration Best Practices
-
-```sql
--- Always include rollback
--- migrations/20240115_001_add_user_status.sql
--- UP
-ALTER TABLE users ADD COLUMN status VARCHAR(20) DEFAULT 'active';
-CREATE INDEX CONCURRENTLY idx_users_status ON users(status);
-
--- DOWN (in separate file or comment)
-DROP INDEX CONCURRENTLY IF EXISTS idx_users_status;
-ALTER TABLE users DROP COLUMN IF EXISTS status;
-```
-
-### Safe Column Addition
-
-```sql
--- SAFE: Add nullable column (no table rewrite)
-ALTER TABLE users ADD COLUMN phone VARCHAR(20);
-
--- SAFE: Add column with volatile default (PG 11+)
-ALTER TABLE users ADD COLUMN created_at TIMESTAMP DEFAULT NOW();
-
--- UNSAFE: Add column with constant default (table rewrite before PG 11)
--- ALTER TABLE users ADD COLUMN score INTEGER DEFAULT 0;
-
--- SAFE alternative for constant default:
-ALTER TABLE users ADD COLUMN score INTEGER;
-UPDATE users SET score = 0 WHERE score IS NULL;
-ALTER TABLE users ALTER COLUMN score SET DEFAULT 0;
-ALTER TABLE users ALTER COLUMN score SET NOT NULL;
-```
-
-### Safe Index Creation
-
-```sql
--- UNSAFE: Locks table
-CREATE INDEX idx_orders_user ON orders(user_id);
-
--- SAFE: Non-blocking
-CREATE INDEX CONCURRENTLY idx_orders_user ON orders(user_id);
-
--- Note: CONCURRENTLY cannot run in a transaction
-```
-
-### Safe Column Removal
-
-```sql
--- Step 1: Stop writing to column (application change)
--- Step 2: Wait for all deployments
--- Step 3: Drop column
-ALTER TABLE users DROP COLUMN IF EXISTS legacy_field;
-```
-
----
-
-## 7. Monitoring and Alerting
-
-### Key Metrics to Monitor
-
-```sql
--- Active connections
-SELECT count(*) FROM pg_stat_activity WHERE state = 'active';
-
--- Connection by state
-SELECT state, count(*)
-FROM pg_stat_activity
-GROUP BY state;
-
--- Long-running queries
-SELECT
-  pid,
-  now() - pg_stat_activity.query_start AS duration,
-  query,
-  state
-FROM pg_stat_activity
-WHERE (now() - pg_stat_activity.query_start) > interval '5 minutes'
-  AND state != 'idle';
-
--- Table bloat
-SELECT
-  schemaname,
-  tablename,
-  pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) as total_size,
-  pg_size_pretty(pg_relation_size(schemaname||'.'||tablename)) as table_size,
-  pg_size_pretty(pg_indexes_size(schemaname||'.'||tablename)) as index_size
-FROM pg_tables
-WHERE schemaname = 'public'
-ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC
-LIMIT 10;
-```
-
-### pg_stat_statements for Query Analysis
-
-```sql
--- Enable extension
-CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
-
--- Find slowest queries
-SELECT
-  round(total_exec_time::numeric, 2) as total_time_ms,
-  calls,
-  round(mean_exec_time::numeric, 2) as avg_time_ms,
-  round((100 * total_exec_time / sum(total_exec_time) over())::numeric, 2) as percentage,
-  query
-FROM pg_stat_statements
-ORDER BY total_exec_time DESC
-LIMIT 10;
-
--- Find most frequent queries
-SELECT
-  calls,
-  round(total_exec_time::numeric, 2) as total_time_ms,
-  round(mean_exec_time::numeric, 2) as avg_time_ms,
-  query
-FROM pg_stat_statements
-ORDER BY calls DESC
-LIMIT 10;
-```
-
-### Alert Thresholds
-
-| Metric | Warning | Critical |
-|--------|---------|----------|
-| Connection usage | > 70% | > 90% |
-| Query time P95 | > 500ms | > 2s |
-| Replication lag | > 30s | > 5m |
-| Disk usage | > 70% | > 85% |
-| Cache hit ratio | < 95% | < 90% |
-
----
-
-## Quick Reference: PostgreSQL Commands
-
-```sql
--- Check table sizes
-SELECT pg_size_pretty(pg_total_relation_size('orders'));
-
--- Check index sizes
-SELECT pg_size_pretty(pg_indexes_size('orders'));
-
--- Kill a query
-SELECT pg_cancel_backend(pid);  -- Graceful
-SELECT pg_terminate_backend(pid);  -- Force
-
--- Check locks
-SELECT * FROM pg_locks WHERE granted = false;
-
--- Vacuum analyze (update statistics)
-VACUUM ANALYZE orders;
-
--- Check autovacuum status
-SELECT * FROM pg_stat_user_tables WHERE relname = 'orders';
-```
diff --git a/.claude/skills/senior-backend/scripts/api_load_tester.py b/.claude/skills/senior-backend/scripts/api_load_tester.py
deleted file mode 100644
index afa35aa..0000000
--- a/.claude/skills/senior-backend/scripts/api_load_tester.py
+++ /dev/null
@@ -1,607 +0,0 @@
-#!/usr/bin/env python3
-"""
-API Load Tester
-
-Performs HTTP load testing with configurable concurrency, measuring latency
-percentiles, throughput, and error rates.
-
-Usage:
-    python api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30
-    python api_load_tester.py https://api.example.com/orders --method POST --body '{"item": 1}'
-    python api_load_tester.py https://api.example.com/v1/users https://api.example.com/v2/users --compare
-"""
-
-import os
-import sys
-import json
-import argparse
-import time
-import statistics
-import threading
-import queue
-from concurrent.futures import ThreadPoolExecutor, as_completed
-from dataclasses import dataclass, field, asdict
-from typing import Dict, List, Optional, Tuple
-from datetime import datetime
-from urllib.request import Request, urlopen
-from urllib.error import URLError, HTTPError
-from urllib.parse import urlparse
-import ssl
-
-
-@dataclass
-class RequestResult:
-    """Result of a single HTTP request."""
-    success: bool
-    status_code: int
-    latency_ms: float
-    error: Optional[str] = None
-    response_size: int = 0
-
-
-@dataclass
-class LoadTestResults:
-    """Aggregated load test results."""
-    target_url: str
-    method: str
-    duration_seconds: float
-    concurrency: int
-    total_requests: int
-    successful_requests: int
-    failed_requests: int
-    requests_per_second: float
-
-    # Latency metrics (milliseconds)
-    latency_min: float
-    latency_max: float
-    latency_avg: float
-    latency_p50: float
-    latency_p90: float
-    latency_p95: float
-    latency_p99: float
-    latency_stddev: float
-
-    # Error breakdown
-    errors_by_type: Dict[str, int] = field(default_factory=dict)
-
-    # Transfer metrics
-    total_bytes_received: int = 0
-    throughput_mbps: float = 0.0
-
-    def success_rate(self) -> float:
-        """Calculate success rate percentage."""
-        if self.total_requests == 0:
-            return 0.0
-        return (self.successful_requests / self.total_requests) * 100
-
-
-def calculate_percentile(data: List[float], percentile: float) -> float:
-    """Calculate percentile from sorted data."""
-    if not data:
-        return 0.0
-    k = (len(data) - 1) * (percentile / 100)
-    f = int(k)
-    c = f + 1 if f + 1 < len(data) else f
-    return data[f] + (data[c] - data[f]) * (k - f)
-
-
-class HTTPClient:
-    """HTTP client with configurable settings."""
-
-    def __init__(self, timeout: float = 30.0, headers: Optional[Dict[str, str]] = None,
-                 verify_ssl: bool = True):
-        self.timeout = timeout
-        self.headers = headers or {}
-        self.verify_ssl = verify_ssl
-
-        # Create SSL context
-        if not verify_ssl:
-            self.ssl_context = ssl.create_default_context()
-            self.ssl_context.check_hostname = False
-            self.ssl_context.verify_mode = ssl.CERT_NONE
-        else:
-            self.ssl_context = None
-
-    def request(self, url: str, method: str = 'GET', body: Optional[bytes] = None) -> RequestResult:
-        """Execute HTTP request and return result."""
-        start_time = time.perf_counter()
-
-        try:
-            request = Request(url, data=body, method=method)
-
-            # Add headers
-            for key, value in self.headers.items():
-                request.add_header(key, value)
-
-            # Add content-type for POST/PUT
-            if body and method in ['POST', 'PUT', 'PATCH']:
-                if 'Content-Type' not in self.headers:
-                    request.add_header('Content-Type', 'application/json')
-
-            # Execute request
-            with urlopen(request, timeout=self.timeout, context=self.ssl_context) as response:
-                response_data = response.read()
-                elapsed = (time.perf_counter() - start_time) * 1000
-
-                return RequestResult(
-                    success=True,
-                    status_code=response.status,
-                    latency_ms=elapsed,
-                    response_size=len(response_data),
-                )
-
-        except HTTPError as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=e.code,
-                latency_ms=elapsed,
-                error=f"HTTP {e.code}: {e.reason}",
-            )
-
-        except URLError as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error=f"Connection error: {str(e.reason)}",
-            )
-
-        except TimeoutError:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error="Connection timeout",
-            )
-
-        except Exception as e:
-            elapsed = (time.perf_counter() - start_time) * 1000
-            return RequestResult(
-                success=False,
-                status_code=0,
-                latency_ms=elapsed,
-                error=str(e),
-            )
-
-
-class LoadTester:
-    """HTTP load testing engine."""
-
-    def __init__(self, url: str, method: str = 'GET', body: Optional[str] = None,
-                 headers: Optional[Dict[str, str]] = None, concurrency: int = 10,
-                 duration: float = 10.0, timeout: float = 30.0, verify_ssl: bool = True):
-        self.url = url
-        self.method = method.upper()
-        self.body = body.encode() if body else None
-        self.headers = headers or {}
-        self.concurrency = concurrency
-        self.duration = duration
-        self.timeout = timeout
-        self.verify_ssl = verify_ssl
-
-        self.results: List[RequestResult] = []
-        self.stop_event = threading.Event()
-        self.results_lock = threading.Lock()
-
-    def run(self) -> LoadTestResults:
-        """Execute load test and return results."""
-        print(f"Load Testing: {self.url}")
-        print(f"Method: {self.method}")
-        print(f"Concurrency: {self.concurrency}")
-        print(f"Duration: {self.duration}s")
-        print("-" * 50)
-
-        self.results = []
-        self.stop_event.clear()
-
-        start_time = time.time()
-
-        # Start worker threads
-        with ThreadPoolExecutor(max_workers=self.concurrency) as executor:
-            futures = []
-            for _ in range(self.concurrency):
-                future = executor.submit(self._worker)
-                futures.append(future)
-
-            # Wait for duration
-            time.sleep(self.duration)
-            self.stop_event.set()
-
-            # Wait for workers to finish
-            for future in as_completed(futures):
-                try:
-                    future.result()
-                except Exception as e:
-                    print(f"Worker error: {e}")
-
-        elapsed_time = time.time() - start_time
-
-        return self._aggregate_results(elapsed_time)
-
-    def _worker(self):
-        """Worker thread that continuously sends requests."""
-        client = HTTPClient(
-            timeout=self.timeout,
-            headers=self.headers,
-            verify_ssl=self.verify_ssl,
-        )
-
-        while not self.stop_event.is_set():
-            result = client.request(self.url, self.method, self.body)
-
-            with self.results_lock:
-                self.results.append(result)
-
-    def _aggregate_results(self, elapsed_time: float) -> LoadTestResults:
-        """Aggregate individual results into summary."""
-        if not self.results:
-            return LoadTestResults(
-                target_url=self.url,
-                method=self.method,
-                duration_seconds=elapsed_time,
-                concurrency=self.concurrency,
-                total_requests=0,
-                successful_requests=0,
-                failed_requests=0,
-                requests_per_second=0,
-                latency_min=0,
-                latency_max=0,
-                latency_avg=0,
-                latency_p50=0,
-                latency_p90=0,
-                latency_p95=0,
-                latency_p99=0,
-                latency_stddev=0,
-            )
-
-        # Separate successful and failed
-        successful = [r for r in self.results if r.success]
-        failed = [r for r in self.results if not r.success]
-
-        # Latency calculations (from successful requests)
-        latencies = sorted([r.latency_ms for r in successful]) if successful else [0]
-
-        # Error breakdown
-        errors_by_type: Dict[str, int] = {}
-        for r in failed:
-            error_type = r.error or 'Unknown'
-            errors_by_type[error_type] = errors_by_type.get(error_type, 0) + 1
-
-        # Calculate throughput
-        total_bytes = sum(r.response_size for r in successful)
-        throughput_mbps = (total_bytes * 8) / (elapsed_time * 1_000_000) if elapsed_time > 0 else 0
-
-        return LoadTestResults(
-            target_url=self.url,
-            method=self.method,
-            duration_seconds=elapsed_time,
-            concurrency=self.concurrency,
-            total_requests=len(self.results),
-            successful_requests=len(successful),
-            failed_requests=len(failed),
-            requests_per_second=len(self.results) / elapsed_time if elapsed_time > 0 else 0,
-            latency_min=min(latencies),
-            latency_max=max(latencies),
-            latency_avg=statistics.mean(latencies) if latencies else 0,
-            latency_p50=calculate_percentile(latencies, 50),
-            latency_p90=calculate_percentile(latencies, 90),
-            latency_p95=calculate_percentile(latencies, 95),
-            latency_p99=calculate_percentile(latencies, 99),
-            latency_stddev=statistics.stdev(latencies) if len(latencies) > 1 else 0,
-            errors_by_type=errors_by_type,
-            total_bytes_received=total_bytes,
-            throughput_mbps=throughput_mbps,
-        )
-
-
-def print_results(results: LoadTestResults, verbose: bool = False):
-    """Print formatted load test results."""
-    print("\n" + "=" * 60)
-    print("LOAD TEST RESULTS")
-    print("=" * 60)
-
-    print(f"\nTarget: {results.target_url}")
-    print(f"Method: {results.method}")
-    print(f"Duration: {results.duration_seconds:.1f}s")
-    print(f"Concurrency: {results.concurrency}")
-
-    print(f"\nTHROUGHPUT:")
-    print(f"  Total requests: {results.total_requests:,}")
-    print(f"  Requests/sec: {results.requests_per_second:.1f}")
-    print(f"  Successful: {results.successful_requests:,} ({results.success_rate():.1f}%)")
-    print(f"  Failed: {results.failed_requests:,}")
-
-    print(f"\nLATENCY (ms):")
-    print(f"  Min: {results.latency_min:.1f}")
-    print(f"  Avg: {results.latency_avg:.1f}")
-    print(f"  P50: {results.latency_p50:.1f}")
-    print(f"  P90: {results.latency_p90:.1f}")
-    print(f"  P95: {results.latency_p95:.1f}")
-    print(f"  P99: {results.latency_p99:.1f}")
-    print(f"  Max: {results.latency_max:.1f}")
-    print(f"  StdDev: {results.latency_stddev:.1f}")
-
-    if results.errors_by_type:
-        print(f"\nERRORS:")
-        for error_type, count in sorted(results.errors_by_type.items(), key=lambda x: -x[1]):
-            print(f"  {error_type}: {count}")
-
-    if verbose:
-        print(f"\nTRANSFER:")
-        print(f"  Total bytes: {results.total_bytes_received:,}")
-        print(f"  Throughput: {results.throughput_mbps:.2f} Mbps")
-
-    # Recommendations
-    print(f"\nRECOMMENDATIONS:")
-
-    if results.latency_p99 > 500:
-        print(f"  Warning: P99 latency ({results.latency_p99:.0f}ms) exceeds 500ms")
-        print(f"    Consider: Connection pooling, query optimization, caching")
-
-    if results.latency_p95 > 200:
-        print(f"  Warning: P95 latency ({results.latency_p95:.0f}ms) exceeds 200ms target")
-
-    if results.success_rate() < 99.0:
-        print(f"  Warning: Success rate ({results.success_rate():.1f}%) below 99%")
-        print(f"    Check server capacity and error logs")
-
-    if results.latency_stddev > results.latency_avg:
-        print(f"  Warning: High latency variance (stddev > avg)")
-        print(f"    Indicates inconsistent performance")
-
-    if results.success_rate() >= 99.0 and results.latency_p95 <= 200:
-        print(f"  Performance looks good for this load level")
-
-    print("=" * 60)
-
-
-def compare_results(results1: LoadTestResults, results2: LoadTestResults):
-    """Compare two load test results."""
-    print("\n" + "=" * 60)
-    print("COMPARISON RESULTS")
-    print("=" * 60)
-
-    print(f"\n{'Metric':<25} {'Endpoint 1':<15} {'Endpoint 2':<15} {'Diff':<15}")
-    print("-" * 70)
-
-    # Helper to format diff
-    def diff_str(v1: float, v2: float, lower_better: bool = True) -> str:
-        if v1 == 0:
-            return "N/A"
-        diff_pct = ((v2 - v1) / v1) * 100
-        symbol = "-" if (diff_pct < 0) == lower_better else "+"
-        color_good = diff_pct < 0 if lower_better else diff_pct > 0
-        return f"{symbol}{abs(diff_pct):.1f}%"
-
-    metrics = [
-        ("Requests/sec", results1.requests_per_second, results2.requests_per_second, False),
-        ("Success rate (%)", results1.success_rate(), results2.success_rate(), False),
-        ("Latency Avg (ms)", results1.latency_avg, results2.latency_avg, True),
-        ("Latency P50 (ms)", results1.latency_p50, results2.latency_p50, True),
-        ("Latency P90 (ms)", results1.latency_p90, results2.latency_p90, True),
-        ("Latency P95 (ms)", results1.latency_p95, results2.latency_p95, True),
-        ("Latency P99 (ms)", results1.latency_p99, results2.latency_p99, True),
-    ]
-
-    for name, v1, v2, lower_better in metrics:
-        print(f"{name:<25} {v1:<15.1f} {v2:<15.1f} {diff_str(v1, v2, lower_better):<15}")
-
-    print("-" * 70)
-
-    # Summary
-    print(f"\nEndpoint 1: {results1.target_url}")
-    print(f"Endpoint 2: {results2.target_url}")
-
-    # Determine winner
-    score1, score2 = 0, 0
-
-    if results1.requests_per_second > results2.requests_per_second:
-        score1 += 1
-    else:
-        score2 += 1
-
-    if results1.latency_p95 < results2.latency_p95:
-        score1 += 1
-    else:
-        score2 += 1
-
-    if results1.success_rate() > results2.success_rate():
-        score1 += 1
-    else:
-        score2 += 1
-
-    print(f"\nOverall: {'Endpoint 1' if score1 > score2 else 'Endpoint 2'} performs better")
-
-    print("=" * 60)
-
-
-class APILoadTester:
-    """Main load tester class with CLI integration."""
-
-    def __init__(self, urls: List[str], method: str = 'GET', body: Optional[str] = None,
-                 headers: Optional[Dict[str, str]] = None, concurrency: int = 10,
-                 duration: float = 10.0, timeout: float = 30.0, compare: bool = False,
-                 verbose: bool = False, verify_ssl: bool = True):
-        self.urls = urls
-        self.method = method
-        self.body = body
-        self.headers = headers or {}
-        self.concurrency = concurrency
-        self.duration = duration
-        self.timeout = timeout
-        self.compare = compare
-        self.verbose = verbose
-        self.verify_ssl = verify_ssl
-
-    def run(self) -> Dict:
-        """Execute load test(s) and return results."""
-        results = []
-
-        for url in self.urls:
-            tester = LoadTester(
-                url=url,
-                method=self.method,
-                body=self.body,
-                headers=self.headers,
-                concurrency=self.concurrency,
-                duration=self.duration,
-                timeout=self.timeout,
-                verify_ssl=self.verify_ssl,
-            )
-
-            result = tester.run()
-            results.append(result)
-
-            if not self.compare:
-                print_results(result, self.verbose)
-
-        if self.compare and len(results) >= 2:
-            compare_results(results[0], results[1])
-
-        return {
-            'status': 'success',
-            'results': [asdict(r) for r in results],
-        }
-
-
-def parse_headers(header_args: Optional[List[str]]) -> Dict[str, str]:
-    """Parse header arguments into dictionary."""
-    headers = {}
-    if header_args:
-        for h in header_args:
-            if ':' in h:
-                key, value = h.split(':', 1)
-                headers[key.strip()] = value.strip()
-    return headers
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='HTTP load testing tool',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s https://api.example.com/users --concurrency 50 --duration 30
-  %(prog)s https://api.example.com/orders --method POST --body '{"item": 1}'
-  %(prog)s https://api.example.com/v1 https://api.example.com/v2 --compare
-  %(prog)s https://api.example.com/health --header "Authorization: Bearer token"
-        '''
-    )
-
-    parser.add_argument(
-        'urls',
-        nargs='+',
-        help='URL(s) to test'
-    )
-    parser.add_argument(
-        '--method', '-m',
-        default='GET',
-        choices=['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-        help='HTTP method (default: GET)'
-    )
-    parser.add_argument(
-        '--body', '-b',
-        help='Request body (JSON string)'
-    )
-    parser.add_argument(
-        '--header', '-H',
-        action='append',
-        dest='headers',
-        help='HTTP header (format: "Name: Value")'
-    )
-    parser.add_argument(
-        '--concurrency', '-c',
-        type=int,
-        default=10,
-        help='Number of concurrent requests (default: 10)'
-    )
-    parser.add_argument(
-        '--duration', '-d',
-        type=float,
-        default=10.0,
-        help='Test duration in seconds (default: 10)'
-    )
-    parser.add_argument(
-        '--timeout', '-t',
-        type=float,
-        default=30.0,
-        help='Request timeout in seconds (default: 30)'
-    )
-    parser.add_argument(
-        '--compare',
-        action='store_true',
-        help='Compare two endpoints (requires two URLs)'
-    )
-    parser.add_argument(
-        '--no-verify-ssl',
-        action='store_true',
-        help='Disable SSL certificate verification'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        help='Output file path for results'
-    )
-
-    args = parser.parse_args()
-
-    # Validate
-    if args.compare and len(args.urls) < 2:
-        print("Error: --compare requires two URLs", file=sys.stderr)
-        sys.exit(1)
-
-    # Parse headers
-    headers = parse_headers(args.headers)
-
-    try:
-        tester = APILoadTester(
-            urls=args.urls,
-            method=args.method,
-            body=args.body,
-            headers=headers,
-            concurrency=args.concurrency,
-            duration=args.duration,
-            timeout=args.timeout,
-            compare=args.compare,
-            verbose=args.verbose,
-            verify_ssl=not args.no_verify_ssl,
-        )
-
-        results = tester.run()
-
-        if args.json:
-            output = json.dumps(results, indent=2)
-            if args.output:
-                with open(args.output, 'w') as f:
-                    f.write(output)
-                print(f"\nResults written to: {args.output}")
-            else:
-                print(output)
-        elif args.output:
-            with open(args.output, 'w') as f:
-                json.dump(results, f, indent=2)
-            print(f"\nResults written to: {args.output}")
-
-    except KeyboardInterrupt:
-        print("\nTest interrupted by user")
-        sys.exit(1)
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.claude/skills/senior-backend/scripts/api_scaffolder.py b/.claude/skills/senior-backend/scripts/api_scaffolder.py
deleted file mode 100644
index 2207861..0000000
--- a/.claude/skills/senior-backend/scripts/api_scaffolder.py
+++ /dev/null
@@ -1,645 +0,0 @@
-#!/usr/bin/env python3
-"""
-API Scaffolder
-
-Generates Express.js route handlers, validation middleware, and TypeScript types
-from OpenAPI specifications (YAML/JSON).
-
-Usage:
-    python api_scaffolder.py openapi.yaml --output src/routes/
-    python api_scaffolder.py openapi.json --framework fastify --output src/
-    python api_scaffolder.py spec.yaml --types-only --output src/types/
-"""
-
-import os
-import sys
-import json
-import argparse
-import re
-from pathlib import Path
-from typing import Dict, List, Optional, Any
-from datetime import datetime
-
-
-def load_yaml_as_json(content: str) -> Dict:
-    """Parse YAML content without PyYAML dependency (basic subset)."""
-    lines = content.split('\n')
-    result = {}
-    stack = [(result, -1)]
-    current_key = None
-    in_array = False
-    array_indent = -1
-
-    for line in lines:
-        stripped = line.lstrip()
-        if not stripped or stripped.startswith('#'):
-            continue
-
-        indent = len(line) - len(stripped)
-
-        # Pop stack until we find the right level
-        while len(stack) > 1 and stack[-1][1] >= indent:
-            stack.pop()
-
-        current_obj = stack[-1][0]
-
-        if stripped.startswith('- '):
-            # Array item
-            value = stripped[2:].strip()
-            if isinstance(current_obj, list):
-                if ':' in value:
-                    # Object in array
-                    key, val = value.split(':', 1)
-                    new_obj = {key.strip(): val.strip().strip('"').strip("'")}
-                    current_obj.append(new_obj)
-                    stack.append((new_obj, indent))
-                else:
-                    current_obj.append(value.strip('"').strip("'"))
-        elif ':' in stripped:
-            key, value = stripped.split(':', 1)
-            key = key.strip()
-            value = value.strip()
-
-            if value == '':
-                # Check next line for array or object
-                new_obj = {}
-                current_obj[key] = new_obj
-                stack.append((new_obj, indent))
-            elif value.startswith('[') and value.endswith(']'):
-                # Inline array
-                items = value[1:-1].split(',')
-                current_obj[key] = [i.strip().strip('"').strip("'") for i in items if i.strip()]
-            else:
-                # Simple value
-                value = value.strip('"').strip("'")
-                if value.lower() == 'true':
-                    value = True
-                elif value.lower() == 'false':
-                    value = False
-                elif value.isdigit():
-                    value = int(value)
-                current_obj[key] = value
-
-    return result
-
-
-def load_spec(spec_path: Path) -> Dict:
-    """Load OpenAPI spec from YAML or JSON file."""
-    content = spec_path.read_text()
-
-    if spec_path.suffix in ['.yaml', '.yml']:
-        try:
-            import yaml
-            return yaml.safe_load(content)
-        except ImportError:
-            # Fallback to basic YAML parser
-            return load_yaml_as_json(content)
-    else:
-        return json.loads(content)
-
-
-def openapi_type_to_ts(schema: Dict) -> str:
-    """Convert OpenAPI schema type to TypeScript type."""
-    if not schema:
-        return 'unknown'
-
-    if '$ref' in schema:
-        ref = schema['$ref']
-        return ref.split('/')[-1]
-
-    type_map = {
-        'string': 'string',
-        'integer': 'number',
-        'number': 'number',
-        'boolean': 'boolean',
-        'object': 'Record<string, unknown>',
-        'array': 'unknown[]',
-    }
-
-    schema_type = schema.get('type', 'unknown')
-
-    if schema_type == 'array':
-        items = schema.get('items', {})
-        item_type = openapi_type_to_ts(items)
-        return f'{item_type}[]'
-
-    if schema_type == 'object':
-        properties = schema.get('properties', {})
-        if properties:
-            props = []
-            required = schema.get('required', [])
-            for name, prop in properties.items():
-                ts_type = openapi_type_to_ts(prop)
-                optional = '?' if name not in required else ''
-                props.append(f'  {name}{optional}: {ts_type};')
-            return '{\n' + '\n'.join(props) + '\n}'
-        return 'Record<string, unknown>'
-
-    if 'enum' in schema:
-        values = ' | '.join(f"'{v}'" for v in schema['enum'])
-        return values
-
-    return type_map.get(schema_type, 'unknown')
-
-
-def generate_zod_schema(schema: Dict, name: str) -> str:
-    """Generate Zod validation schema from OpenAPI schema."""
-    if not schema:
-        return f'export const {name}Schema = z.unknown();'
-
-    def schema_to_zod(s: Dict) -> str:
-        if '$ref' in s:
-            ref_name = s['$ref'].split('/')[-1]
-            return f'{ref_name}Schema'
-
-        s_type = s.get('type', 'unknown')
-
-        if s_type == 'string':
-            zod = 'z.string()'
-            if 'minLength' in s:
-                zod += f'.min({s["minLength"]})'
-            if 'maxLength' in s:
-                zod += f'.max({s["maxLength"]})'
-            if 'pattern' in s:
-                zod += f'.regex(/{s["pattern"]}/)'
-            if s.get('format') == 'email':
-                zod += '.email()'
-            if s.get('format') == 'uuid':
-                zod += '.uuid()'
-            if 'enum' in s:
-                values = ', '.join(f"'{v}'" for v in s['enum'])
-                return f'z.enum([{values}])'
-            return zod
-
-        if s_type == 'integer':
-            zod = 'z.number().int()'
-            if 'minimum' in s:
-                zod += f'.min({s["minimum"]})'
-            if 'maximum' in s:
-                zod += f'.max({s["maximum"]})'
-            return zod
-
-        if s_type == 'number':
-            zod = 'z.number()'
-            if 'minimum' in s:
-                zod += f'.min({s["minimum"]})'
-            if 'maximum' in s:
-                zod += f'.max({s["maximum"]})'
-            return zod
-
-        if s_type == 'boolean':
-            return 'z.boolean()'
-
-        if s_type == 'array':
-            items_zod = schema_to_zod(s.get('items', {}))
-            return f'z.array({items_zod})'
-
-        if s_type == 'object':
-            properties = s.get('properties', {})
-            required = s.get('required', [])
-            if not properties:
-                return 'z.record(z.unknown())'
-
-            props = []
-            for prop_name, prop_schema in properties.items():
-                prop_zod = schema_to_zod(prop_schema)
-                if prop_name not in required:
-                    prop_zod += '.optional()'
-                props.append(f'  {prop_name}: {prop_zod},')
-
-            return 'z.object({\n' + '\n'.join(props) + '\n})'
-
-        return 'z.unknown()'
-
-    return f'export const {name}Schema = {schema_to_zod(schema)};'
-
-
-def to_camel_case(s: str) -> str:
-    """Convert string to camelCase."""
-    s = re.sub(r'[^a-zA-Z0-9]', ' ', s)
-    words = s.split()
-    if not words:
-        return s
-    return words[0].lower() + ''.join(w.capitalize() for w in words[1:])
-
-
-def to_pascal_case(s: str) -> str:
-    """Convert string to PascalCase."""
-    s = re.sub(r'[^a-zA-Z0-9]', ' ', s)
-    return ''.join(w.capitalize() for w in s.split())
-
-
-def extract_path_params(path: str) -> List[str]:
-    """Extract path parameters from OpenAPI path."""
-    return re.findall(r'\{(\w+)\}', path)
-
-
-def openapi_path_to_express(path: str) -> str:
-    """Convert OpenAPI path to Express path format."""
-    return re.sub(r'\{(\w+)\}', r':\1', path)
-
-
-class APIScaffolder:
-    """Generate Express.js routes from OpenAPI specification."""
-
-    SUPPORTED_FRAMEWORKS = ['express', 'fastify', 'koa']
-
-    def __init__(self, spec_path: str, output_dir: str, framework: str = 'express',
-                 types_only: bool = False, verbose: bool = False):
-        self.spec_path = Path(spec_path)
-        self.output_dir = Path(output_dir)
-        self.framework = framework
-        self.types_only = types_only
-        self.verbose = verbose
-        self.spec: Dict = {}
-        self.generated_files: List[str] = []
-
-    def run(self) -> Dict:
-        """Execute scaffolding process."""
-        print(f"API Scaffolder - {self.framework.capitalize()}")
-        print(f"Spec: {self.spec_path}")
-        print(f"Output: {self.output_dir}")
-        print("-" * 50)
-
-        self.validate()
-        self.load_spec()
-        self.ensure_output_dir()
-
-        if self.types_only:
-            self.generate_types()
-        else:
-            self.generate_types()
-            self.generate_validators()
-            self.generate_routes()
-            self.generate_index()
-
-        return {
-            'status': 'success',
-            'spec': str(self.spec_path),
-            'output': str(self.output_dir),
-            'framework': self.framework,
-            'generated_files': self.generated_files,
-            'routes_count': len(self.get_operations()),
-            'types_count': len(self.get_schemas()),
-        }
-
-    def validate(self):
-        """Validate inputs."""
-        if not self.spec_path.exists():
-            raise FileNotFoundError(f"Spec file not found: {self.spec_path}")
-
-        if self.framework not in self.SUPPORTED_FRAMEWORKS:
-            raise ValueError(f"Unsupported framework: {self.framework}")
-
-    def load_spec(self):
-        """Load and parse OpenAPI specification."""
-        self.spec = load_spec(self.spec_path)
-
-        if self.verbose:
-            title = self.spec.get('info', {}).get('title', 'Unknown')
-            version = self.spec.get('info', {}).get('version', '0.0.0')
-            print(f"Loaded: {title} v{version}")
-
-    def ensure_output_dir(self):
-        """Create output directory if needed."""
-        self.output_dir.mkdir(parents=True, exist_ok=True)
-
-    def get_schemas(self) -> Dict:
-        """Get component schemas from spec."""
-        return self.spec.get('components', {}).get('schemas', {})
-
-    def get_operations(self) -> List[Dict]:
-        """Extract all operations from spec."""
-        operations = []
-        paths = self.spec.get('paths', {})
-
-        for path, methods in paths.items():
-            if not isinstance(methods, dict):
-                continue
-
-            for method, details in methods.items():
-                if method.lower() not in ['get', 'post', 'put', 'patch', 'delete']:
-                    continue
-
-                if not isinstance(details, dict):
-                    continue
-
-                op_id = details.get('operationId', f'{method}_{path}'.replace('/', '_'))
-
-                operations.append({
-                    'path': path,
-                    'method': method.lower(),
-                    'operation_id': op_id,
-                    'summary': details.get('summary', ''),
-                    'parameters': details.get('parameters', []),
-                    'request_body': details.get('requestBody', {}),
-                    'responses': details.get('responses', {}),
-                    'tags': details.get('tags', ['default']),
-                })
-
-        return operations
-
-    def generate_types(self):
-        """Generate TypeScript type definitions."""
-        schemas = self.get_schemas()
-
-        lines = [
-            '// Auto-generated TypeScript types',
-            f'// Generated from: {self.spec_path.name}',
-            f'// Date: {datetime.now().isoformat()}',
-            '',
-        ]
-
-        for name, schema in schemas.items():
-            ts_type = openapi_type_to_ts(schema)
-            if ts_type.startswith('{'):
-                lines.append(f'export interface {name} {ts_type}')
-            else:
-                lines.append(f'export type {name} = {ts_type};')
-            lines.append('')
-
-        # Generate request/response types from operations
-        for op in self.get_operations():
-            op_name = to_pascal_case(op['operation_id'])
-
-            # Request body type
-            req_body = op.get('request_body', {})
-            if req_body:
-                content = req_body.get('content', {})
-                json_content = content.get('application/json', {})
-                schema = json_content.get('schema', {})
-                if schema and '$ref' not in schema:
-                    ts_type = openapi_type_to_ts(schema)
-                    lines.append(f'export interface {op_name}Request {ts_type}')
-                    lines.append('')
-
-            # Response type (200 response)
-            responses = op.get('responses', {})
-            success_resp = responses.get('200', responses.get('201', {}))
-            if success_resp:
-                content = success_resp.get('content', {})
-                json_content = content.get('application/json', {})
-                schema = json_content.get('schema', {})
-                if schema and '$ref' not in schema:
-                    ts_type = openapi_type_to_ts(schema)
-                    lines.append(f'export interface {op_name}Response {ts_type}')
-                    lines.append('')
-
-        types_file = self.output_dir / 'types.ts'
-        types_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(types_file))
-        print(f"  Generated: {types_file}")
-
-    def generate_validators(self):
-        """Generate Zod validation schemas."""
-        schemas = self.get_schemas()
-
-        lines = [
-            "import { z } from 'zod';",
-            '',
-            '// Auto-generated Zod validation schemas',
-            f'// Generated from: {self.spec_path.name}',
-            '',
-        ]
-
-        for name, schema in schemas.items():
-            zod_schema = generate_zod_schema(schema, name)
-            lines.append(zod_schema)
-            lines.append(f'export type {name} = z.infer<typeof {name}Schema>;')
-            lines.append('')
-
-        # Generate validation middleware
-        lines.extend([
-            '// Validation middleware factory',
-            'import { Request, Response, NextFunction } from "express";',
-            '',
-            'export function validate<T>(schema: z.ZodSchema<T>) {',
-            '  return (req: Request, res: Response, next: NextFunction) => {',
-            '    const result = schema.safeParse(req.body);',
-            '    if (!result.success) {',
-            '      return res.status(400).json({',
-            '        error: {',
-            '          code: "VALIDATION_ERROR",',
-            '          message: "Request validation failed",',
-            '          details: result.error.errors.map(e => ({',
-            '            field: e.path.join("."),',
-            '            message: e.message,',
-            '          })),',
-            '        },',
-            '      });',
-            '    }',
-            '    req.body = result.data;',
-            '    next();',
-            '  };',
-            '}',
-        ])
-
-        validators_file = self.output_dir / 'validators.ts'
-        validators_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(validators_file))
-        print(f"  Generated: {validators_file}")
-
-    def generate_routes(self):
-        """Generate route handlers."""
-        operations = self.get_operations()
-
-        # Group by tag
-        routes_by_tag: Dict[str, List[Dict]] = {}
-        for op in operations:
-            tag = op['tags'][0] if op['tags'] else 'default'
-            if tag not in routes_by_tag:
-                routes_by_tag[tag] = []
-            routes_by_tag[tag].append(op)
-
-        # Generate a route file per tag
-        for tag, ops in routes_by_tag.items():
-            self.generate_route_file(tag, ops)
-
-    def generate_route_file(self, tag: str, operations: List[Dict]):
-        """Generate a single route file."""
-        tag_name = to_camel_case(tag)
-
-        lines = [
-            "import { Router, Request, Response, NextFunction } from 'express';",
-            "import { validate } from './validators';",
-            "import * as schemas from './validators';",
-            '',
-            f'const router = Router();',
-            '',
-        ]
-
-        for op in operations:
-            method = op['method']
-            path = openapi_path_to_express(op['path'])
-            handler_name = to_camel_case(op['operation_id'])
-            summary = op.get('summary', '')
-
-            # Check if has request body
-            req_body = op.get('request_body', {})
-            has_body = bool(req_body.get('content', {}).get('application/json'))
-
-            # Find schema reference
-            schema_ref = None
-            if has_body:
-                content = req_body.get('content', {}).get('application/json', {})
-                schema = content.get('schema', {})
-                if '$ref' in schema:
-                    schema_ref = schema['$ref'].split('/')[-1]
-
-            lines.append(f'/**')
-            if summary:
-                lines.append(f' * {summary}')
-            lines.append(f' * {method.upper()} {op["path"]}')
-            lines.append(f' */')
-
-            middleware = ''
-            if schema_ref:
-                middleware = f'validate(schemas.{schema_ref}Schema), '
-
-            lines.append(f"router.{method}('{path}', {middleware}async (req: Request, res: Response, next: NextFunction) => {{")
-            lines.append('  try {')
-
-            # Extract path params
-            path_params = extract_path_params(op['path'])
-            if path_params:
-                lines.append(f"    const {{ {', '.join(path_params)} }} = req.params;")
-
-            lines.append('')
-            lines.append(f'    // TODO: Implement {handler_name}')
-            lines.append('')
-
-            # Default response based on method
-            if method == 'post':
-                lines.append("    res.status(201).json({ message: 'Created' });")
-            elif method == 'delete':
-                lines.append("    res.status(204).send();")
-            else:
-                lines.append("    res.json({ message: 'OK' });")
-
-            lines.append('  } catch (err) {')
-            lines.append('    next(err);')
-            lines.append('  }')
-            lines.append('});')
-            lines.append('')
-
-        lines.append(f'export default router;')
-
-        route_file = self.output_dir / f'{tag_name}.routes.ts'
-        route_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(route_file))
-        print(f"  Generated: {route_file} ({len(operations)} handlers)")
-
-    def generate_index(self):
-        """Generate index file that combines all routes."""
-        operations = self.get_operations()
-
-        # Get unique tags
-        tags = set()
-        for op in operations:
-            tag = op['tags'][0] if op['tags'] else 'default'
-            tags.add(tag)
-
-        lines = [
-            "import { Router } from 'express';",
-            '',
-        ]
-
-        for tag in sorted(tags):
-            tag_name = to_camel_case(tag)
-            lines.append(f"import {tag_name}Routes from './{tag_name}.routes';")
-
-        lines.extend([
-            '',
-            'const router = Router();',
-            '',
-        ])
-
-        for tag in sorted(tags):
-            tag_name = to_camel_case(tag)
-            # Use tag as base path
-            base_path = '/' + tag.lower().replace(' ', '-')
-            lines.append(f"router.use('{base_path}', {tag_name}Routes);")
-
-        lines.extend([
-            '',
-            'export default router;',
-        ])
-
-        index_file = self.output_dir / 'index.ts'
-        index_file.write_text('\n'.join(lines))
-        self.generated_files.append(str(index_file))
-        print(f"  Generated: {index_file}")
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='Generate Express.js routes from OpenAPI specification',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s openapi.yaml --output src/routes/
-  %(prog)s spec.json --framework fastify --output src/api/
-  %(prog)s openapi.yaml --types-only --output src/types/
-        '''
-    )
-
-    parser.add_argument(
-        'spec',
-        help='Path to OpenAPI specification (YAML or JSON)'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        default='./generated',
-        help='Output directory (default: ./generated)'
-    )
-    parser.add_argument(
-        '--framework', '-f',
-        choices=['express', 'fastify', 'koa'],
-        default='express',
-        help='Target framework (default: express)'
-    )
-    parser.add_argument(
-        '--types-only',
-        action='store_true',
-        help='Generate only TypeScript types'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-
-    args = parser.parse_args()
-
-    try:
-        scaffolder = APIScaffolder(
-            spec_path=args.spec,
-            output_dir=args.output,
-            framework=args.framework,
-            types_only=args.types_only,
-            verbose=args.verbose,
-        )
-
-        results = scaffolder.run()
-
-        print("-" * 50)
-        print(f"Generated {results['routes_count']} route handlers")
-        print(f"Generated {results['types_count']} type definitions")
-        print(f"Output: {results['output']}")
-
-        if args.json:
-            print(json.dumps(results, indent=2))
-
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.claude/skills/senior-backend/scripts/database_migration_tool.py b/.claude/skills/senior-backend/scripts/database_migration_tool.py
deleted file mode 100644
index 9bb0e27..0000000
--- a/.claude/skills/senior-backend/scripts/database_migration_tool.py
+++ /dev/null
@@ -1,858 +0,0 @@
-#!/usr/bin/env python3
-"""
-Database Migration Tool
-
-Analyzes SQL schema files, detects potential issues, suggests indexes,
-and generates migration scripts with rollback support.
-
-Usage:
-    python database_migration_tool.py schema.sql --analyze
-    python database_migration_tool.py old.sql --compare new.sql --output migrations/
-    python database_migration_tool.py schema.sql --suggest-indexes
-"""
-
-import os
-import sys
-import json
-import argparse
-import re
-from pathlib import Path
-from typing import Dict, List, Optional, Set, Tuple
-from datetime import datetime
-from dataclasses import dataclass, field, asdict
-
-
-@dataclass
-class Column:
-    """Database column definition."""
-    name: str
-    data_type: str
-    nullable: bool = True
-    default: Optional[str] = None
-    primary_key: bool = False
-    unique: bool = False
-    references: Optional[str] = None
-
-
-@dataclass
-class Index:
-    """Database index definition."""
-    name: str
-    table: str
-    columns: List[str]
-    unique: bool = False
-    partial: Optional[str] = None
-
-
-@dataclass
-class Table:
-    """Database table definition."""
-    name: str
-    columns: Dict[str, Column] = field(default_factory=dict)
-    indexes: List[Index] = field(default_factory=list)
-    primary_key: List[str] = field(default_factory=list)
-    foreign_keys: List[Dict] = field(default_factory=list)
-
-
-@dataclass
-class Issue:
-    """Schema issue or recommendation."""
-    severity: str  # 'error', 'warning', 'info'
-    category: str  # 'index', 'naming', 'type', 'constraint'
-    table: str
-    message: str
-    suggestion: Optional[str] = None
-
-
-class SQLParser:
-    """Parse SQL DDL statements."""
-
-    # Common patterns
-    CREATE_TABLE_PATTERN = re.compile(
-        r'CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?(\w+)["`]?\s*\((.*?)\)\s*;',
-        re.IGNORECASE | re.DOTALL
-    )
-
-    CREATE_INDEX_PATTERN = re.compile(
-        r'CREATE\s+(UNIQUE\s+)?INDEX\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?(\w+)["`]?\s+'
-        r'ON\s+["`]?(\w+)["`]?\s*\(([^)]+)\)(?:\s+WHERE\s+(.+?))?;',
-        re.IGNORECASE | re.DOTALL
-    )
-
-    COLUMN_PATTERN = re.compile(
-        r'["`]?(\w+)["`]?\s+'  # Column name
-        r'(\w+(?:\s*\([^)]+\))?)'  # Data type
-        r'([^,]*)',  # Constraints
-        re.IGNORECASE
-    )
-
-    FK_PATTERN = re.compile(
-        r'FOREIGN\s+KEY\s*\(["`]?(\w+)["`]?\)\s+'
-        r'REFERENCES\s+["`]?(\w+)["`]?\s*\(["`]?(\w+)["`]?\)',
-        re.IGNORECASE
-    )
-
-    def parse(self, sql: str) -> Dict[str, Table]:
-        """Parse SQL and return table definitions."""
-        tables = {}
-
-        # Parse CREATE TABLE statements
-        for match in self.CREATE_TABLE_PATTERN.finditer(sql):
-            table_name = match.group(1)
-            body = match.group(2)
-            table = self._parse_table_body(table_name, body)
-            tables[table_name] = table
-
-        # Parse CREATE INDEX statements
-        for match in self.CREATE_INDEX_PATTERN.finditer(sql):
-            unique = bool(match.group(1))
-            index_name = match.group(2)
-            table_name = match.group(3)
-            columns = [c.strip().strip('"`') for c in match.group(4).split(',')]
-            where_clause = match.group(5)
-
-            index = Index(
-                name=index_name,
-                table=table_name,
-                columns=columns,
-                unique=unique,
-                partial=where_clause.strip() if where_clause else None
-            )
-
-            if table_name in tables:
-                tables[table_name].indexes.append(index)
-
-        return tables
-
-    def _parse_table_body(self, table_name: str, body: str) -> Table:
-        """Parse table body (columns, constraints)."""
-        table = Table(name=table_name)
-
-        # Split by comma, but respect parentheses
-        parts = self._split_by_comma(body)
-
-        for part in parts:
-            part = part.strip()
-
-            # Skip empty parts
-            if not part:
-                continue
-
-            # Check for PRIMARY KEY constraint
-            if part.upper().startswith('PRIMARY KEY'):
-                pk_match = re.search(r'PRIMARY\s+KEY\s*\(([^)]+)\)', part, re.IGNORECASE)
-                if pk_match:
-                    cols = [c.strip().strip('"`') for c in pk_match.group(1).split(',')]
-                    table.primary_key = cols
-
-            # Check for FOREIGN KEY constraint
-            elif part.upper().startswith('FOREIGN KEY'):
-                fk_match = self.FK_PATTERN.search(part)
-                if fk_match:
-                    table.foreign_keys.append({
-                        'column': fk_match.group(1),
-                        'ref_table': fk_match.group(2),
-                        'ref_column': fk_match.group(3),
-                    })
-
-            # Check for CONSTRAINT
-            elif part.upper().startswith('CONSTRAINT'):
-                # Handle named constraints
-                if 'PRIMARY KEY' in part.upper():
-                    pk_match = re.search(r'PRIMARY\s+KEY\s*\(([^)]+)\)', part, re.IGNORECASE)
-                    if pk_match:
-                        cols = [c.strip().strip('"`') for c in pk_match.group(1).split(',')]
-                        table.primary_key = cols
-                elif 'FOREIGN KEY' in part.upper():
-                    fk_match = self.FK_PATTERN.search(part)
-                    if fk_match:
-                        table.foreign_keys.append({
-                            'column': fk_match.group(1),
-                            'ref_table': fk_match.group(2),
-                            'ref_column': fk_match.group(3),
-                        })
-
-            # Regular column definition
-            else:
-                col_match = self.COLUMN_PATTERN.match(part)
-                if col_match:
-                    col_name = col_match.group(1)
-                    col_type = col_match.group(2)
-                    constraints = col_match.group(3).upper() if col_match.group(3) else ''
-
-                    column = Column(
-                        name=col_name,
-                        data_type=col_type.upper(),
-                        nullable='NOT NULL' not in constraints,
-                        primary_key='PRIMARY KEY' in constraints,
-                        unique='UNIQUE' in constraints,
-                    )
-
-                    # Extract default value
-                    default_match = re.search(r'DEFAULT\s+(\S+)', constraints, re.IGNORECASE)
-                    if default_match:
-                        column.default = default_match.group(1)
-
-                    # Extract references
-                    ref_match = re.search(
-                        r'REFERENCES\s+["`]?(\w+)["`]?\s*\(["`]?(\w+)["`]?\)',
-                        constraints,
-                        re.IGNORECASE
-                    )
-                    if ref_match:
-                        column.references = f"{ref_match.group(1)}({ref_match.group(2)})"
-                        table.foreign_keys.append({
-                            'column': col_name,
-                            'ref_table': ref_match.group(1),
-                            'ref_column': ref_match.group(2),
-                        })
-
-                    if column.primary_key and col_name not in table.primary_key:
-                        table.primary_key.append(col_name)
-
-                    table.columns[col_name] = column
-
-        return table
-
-    def _split_by_comma(self, s: str) -> List[str]:
-        """Split string by comma, respecting parentheses."""
-        parts = []
-        current = []
-        depth = 0
-
-        for char in s:
-            if char == '(':
-                depth += 1
-            elif char == ')':
-                depth -= 1
-            elif char == ',' and depth == 0:
-                parts.append(''.join(current))
-                current = []
-                continue
-            current.append(char)
-
-        if current:
-            parts.append(''.join(current))
-
-        return parts
-
-
-class SchemaAnalyzer:
-    """Analyze database schema for issues and optimizations."""
-
-    # Columns that typically need indexes (foreign keys)
-    FK_COLUMN_PATTERNS = ['_id', 'Id', '_ID']
-
-    # Columns that typically need indexes for filtering
-    FILTER_COLUMN_PATTERNS = ['status', 'state', 'type', 'category', 'active', 'enabled', 'deleted']
-
-    # Columns that typically need indexes for sorting/ordering
-    SORT_COLUMN_PATTERNS = ['created_at', 'updated_at', 'date', 'timestamp', 'order', 'position']
-
-    def __init__(self, tables: Dict[str, Table]):
-        self.tables = tables
-        self.issues: List[Issue] = []
-
-    def analyze(self) -> List[Issue]:
-        """Run all analysis checks."""
-        self.issues = []
-
-        for table_name, table in self.tables.items():
-            self._check_naming_conventions(table)
-            self._check_primary_key(table)
-            self._check_foreign_key_indexes(table)
-            self._check_common_filter_columns(table)
-            self._check_timestamp_columns(table)
-            self._check_data_types(table)
-
-        return self.issues
-
-    def _check_naming_conventions(self, table: Table):
-        """Check table and column naming conventions."""
-        # Table name should be lowercase
-        if table.name != table.name.lower():
-            self.issues.append(Issue(
-                severity='warning',
-                category='naming',
-                table=table.name,
-                message=f"Table name '{table.name}' should be lowercase",
-                suggestion=f"Rename to '{table.name.lower()}'"
-            ))
-
-        # Table name should be plural (basic check)
-        if not table.name.endswith('s') and not table.name.endswith('es'):
-            self.issues.append(Issue(
-                severity='info',
-                category='naming',
-                table=table.name,
-                message=f"Table name '{table.name}' should typically be plural",
-            ))
-
-        for col_name, col in table.columns.items():
-            # Column names should be lowercase with underscores
-            if col_name != col_name.lower():
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='naming',
-                    table=table.name,
-                    message=f"Column '{col_name}' should use snake_case",
-                    suggestion=f"Rename to '{self._to_snake_case(col_name)}'"
-                ))
-
-    def _check_primary_key(self, table: Table):
-        """Check for missing primary key."""
-        if not table.primary_key:
-            self.issues.append(Issue(
-                severity='error',
-                category='constraint',
-                table=table.name,
-                message=f"Table '{table.name}' has no primary key",
-                suggestion="Add a primary key column (e.g., 'id SERIAL PRIMARY KEY')"
-            ))
-
-    def _check_foreign_key_indexes(self, table: Table):
-        """Check that foreign key columns have indexes."""
-        indexed_columns = set()
-        for index in table.indexes:
-            indexed_columns.update(index.columns)
-
-        # Primary key columns are implicitly indexed
-        indexed_columns.update(table.primary_key)
-
-        for fk in table.foreign_keys:
-            fk_col = fk['column']
-            if fk_col not in indexed_columns:
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='index',
-                    table=table.name,
-                    message=f"Foreign key column '{fk_col}' is not indexed",
-                    suggestion=f"CREATE INDEX idx_{table.name}_{fk_col} ON {table.name}({fk_col});"
-                ))
-
-        # Also check columns that look like foreign keys but aren't declared
-        for col_name in table.columns:
-            if any(col_name.endswith(pattern) for pattern in self.FK_COLUMN_PATTERNS):
-                if col_name not in indexed_columns:
-                    # Check if it's actually a declared FK
-                    is_declared_fk = any(fk['column'] == col_name for fk in table.foreign_keys)
-                    if not is_declared_fk:
-                        self.issues.append(Issue(
-                            severity='info',
-                            category='index',
-                            table=table.name,
-                            message=f"Column '{col_name}' looks like a foreign key but has no index",
-                            suggestion=f"CREATE INDEX idx_{table.name}_{col_name} ON {table.name}({col_name});"
-                        ))
-
-    def _check_common_filter_columns(self, table: Table):
-        """Check for indexes on commonly filtered columns."""
-        indexed_columns = set()
-        for index in table.indexes:
-            indexed_columns.update(index.columns)
-        indexed_columns.update(table.primary_key)
-
-        for col_name in table.columns:
-            col_lower = col_name.lower()
-            if any(pattern in col_lower for pattern in self.FILTER_COLUMN_PATTERNS):
-                if col_name not in indexed_columns:
-                    self.issues.append(Issue(
-                        severity='info',
-                        category='index',
-                        table=table.name,
-                        message=f"Column '{col_name}' is commonly used for filtering but has no index",
-                        suggestion=f"CREATE INDEX idx_{table.name}_{col_name} ON {table.name}({col_name});"
-                    ))
-
-    def _check_timestamp_columns(self, table: Table):
-        """Check for indexes on timestamp columns used for sorting."""
-        has_created_at = 'created_at' in table.columns
-        has_updated_at = 'updated_at' in table.columns
-
-        if not has_created_at:
-            self.issues.append(Issue(
-                severity='info',
-                category='convention',
-                table=table.name,
-                message=f"Table '{table.name}' has no 'created_at' column",
-                suggestion="Consider adding: created_at TIMESTAMP DEFAULT NOW()"
-            ))
-
-        if not has_updated_at:
-            self.issues.append(Issue(
-                severity='info',
-                category='convention',
-                table=table.name,
-                message=f"Table '{table.name}' has no 'updated_at' column",
-                suggestion="Consider adding: updated_at TIMESTAMP DEFAULT NOW()"
-            ))
-
-    def _check_data_types(self, table: Table):
-        """Check for potential data type issues."""
-        for col_name, col in table.columns.items():
-            dtype = col.data_type.upper()
-
-            # Check for VARCHAR without length
-            if 'VARCHAR' in dtype and '(' not in dtype:
-                self.issues.append(Issue(
-                    severity='warning',
-                    category='type',
-                    table=table.name,
-                    message=f"Column '{col_name}' uses VARCHAR without length",
-                    suggestion="Specify a maximum length, e.g., VARCHAR(255)"
-                ))
-
-            # Check for FLOAT/DOUBLE for monetary values
-            if 'FLOAT' in dtype or 'DOUBLE' in dtype:
-                if 'price' in col_name.lower() or 'amount' in col_name.lower() or 'total' in col_name.lower():
-                    self.issues.append(Issue(
-                        severity='warning',
-                        category='type',
-                        table=table.name,
-                        message=f"Column '{col_name}' uses floating point for monetary value",
-                        suggestion="Use DECIMAL or NUMERIC for monetary values"
-                    ))
-
-            # Check for TEXT columns that might benefit from length limits
-            if dtype == 'TEXT':
-                if 'email' in col_name.lower() or 'url' in col_name.lower():
-                    self.issues.append(Issue(
-                        severity='info',
-                        category='type',
-                        table=table.name,
-                        message=f"Column '{col_name}' uses TEXT but might benefit from VARCHAR",
-                        suggestion=f"Consider VARCHAR(255) for {col_name}"
-                    ))
-
-    def _to_snake_case(self, name: str) -> str:
-        """Convert name to snake_case."""
-        s1 = re.sub('(.)([A-Z][a-z]+)', r'\1_\2', name)
-        return re.sub('([a-z0-9])([A-Z])', r'\1_\2', s1).lower()
-
-
-class MigrationGenerator:
-    """Generate migration scripts from schema differences."""
-
-    def __init__(self, old_tables: Dict[str, Table], new_tables: Dict[str, Table]):
-        self.old_tables = old_tables
-        self.new_tables = new_tables
-
-    def generate(self) -> Tuple[str, str]:
-        """Generate UP and DOWN migration scripts."""
-        up_statements = []
-        down_statements = []
-
-        # Find new tables
-        for table_name, table in self.new_tables.items():
-            if table_name not in self.old_tables:
-                up_statements.append(self._generate_create_table(table))
-                down_statements.append(f"DROP TABLE IF EXISTS {table_name};")
-
-        # Find removed tables
-        for table_name, table in self.old_tables.items():
-            if table_name not in self.new_tables:
-                up_statements.append(f"DROP TABLE IF EXISTS {table_name};")
-                down_statements.append(self._generate_create_table(table))
-
-        # Find modified tables
-        for table_name in set(self.old_tables.keys()) & set(self.new_tables.keys()):
-            old_table = self.old_tables[table_name]
-            new_table = self.new_tables[table_name]
-            up, down = self._compare_tables(old_table, new_table)
-            up_statements.extend(up)
-            down_statements.extend(down)
-
-        up_sql = '\n\n'.join(up_statements) if up_statements else '-- No changes'
-        down_sql = '\n\n'.join(down_statements) if down_statements else '-- No changes'
-
-        return up_sql, down_sql
-
-    def _generate_create_table(self, table: Table) -> str:
-        """Generate CREATE TABLE statement."""
-        lines = [f"CREATE TABLE {table.name} ("]
-
-        col_defs = []
-        for col_name, col in table.columns.items():
-            col_def = f"  {col_name} {col.data_type}"
-            if not col.nullable:
-                col_def += " NOT NULL"
-            if col.default:
-                col_def += f" DEFAULT {col.default}"
-            if col.primary_key and len(table.primary_key) == 1:
-                col_def += " PRIMARY KEY"
-            if col.unique:
-                col_def += " UNIQUE"
-            col_defs.append(col_def)
-
-        # Add composite primary key
-        if len(table.primary_key) > 1:
-            pk_cols = ', '.join(table.primary_key)
-            col_defs.append(f"  PRIMARY KEY ({pk_cols})")
-
-        # Add foreign keys
-        for fk in table.foreign_keys:
-            col_defs.append(
-                f"  FOREIGN KEY ({fk['column']}) REFERENCES {fk['ref_table']}({fk['ref_column']})"
-            )
-
-        lines.append(',\n'.join(col_defs))
-        lines.append(");")
-
-        return '\n'.join(lines)
-
-    def _compare_tables(self, old: Table, new: Table) -> Tuple[List[str], List[str]]:
-        """Compare two tables and generate ALTER statements."""
-        up = []
-        down = []
-
-        # New columns
-        for col_name, col in new.columns.items():
-            if col_name not in old.columns:
-                up.append(f"ALTER TABLE {new.name} ADD COLUMN {col_name} {col.data_type}"
-                         + (" NOT NULL" if not col.nullable else "")
-                         + (f" DEFAULT {col.default}" if col.default else "") + ";")
-                down.append(f"ALTER TABLE {new.name} DROP COLUMN IF EXISTS {col_name};")
-
-        # Removed columns
-        for col_name, col in old.columns.items():
-            if col_name not in new.columns:
-                up.append(f"ALTER TABLE {old.name} DROP COLUMN IF EXISTS {col_name};")
-                down.append(f"ALTER TABLE {old.name} ADD COLUMN {col_name} {col.data_type}"
-                           + (" NOT NULL" if not col.nullable else "")
-                           + (f" DEFAULT {col.default}" if col.default else "") + ";")
-
-        # Modified columns (type changes)
-        for col_name in set(old.columns.keys()) & set(new.columns.keys()):
-            old_col = old.columns[col_name]
-            new_col = new.columns[col_name]
-
-            if old_col.data_type != new_col.data_type:
-                up.append(f"ALTER TABLE {new.name} ALTER COLUMN {col_name} TYPE {new_col.data_type};")
-                down.append(f"ALTER TABLE {old.name} ALTER COLUMN {col_name} TYPE {old_col.data_type};")
-
-        # New indexes
-        old_index_names = {idx.name for idx in old.indexes}
-        for idx in new.indexes:
-            if idx.name not in old_index_names:
-                unique = "UNIQUE " if idx.unique else ""
-                cols = ', '.join(idx.columns)
-                where = f" WHERE {idx.partial}" if idx.partial else ""
-                up.append(f"CREATE {unique}INDEX CONCURRENTLY {idx.name} ON {idx.table}({cols}){where};")
-                down.append(f"DROP INDEX IF EXISTS {idx.name};")
-
-        # Removed indexes
-        new_index_names = {idx.name for idx in new.indexes}
-        for idx in old.indexes:
-            if idx.name not in new_index_names:
-                unique = "UNIQUE " if idx.unique else ""
-                cols = ', '.join(idx.columns)
-                where = f" WHERE {idx.partial}" if idx.partial else ""
-                up.append(f"DROP INDEX IF EXISTS {idx.name};")
-                down.append(f"CREATE {unique}INDEX {idx.name} ON {idx.table}({cols}){where};")
-
-        return up, down
-
-
-class DatabaseMigrationTool:
-    """Main tool for database migration analysis."""
-
-    def __init__(self, schema_path: str, compare_path: Optional[str] = None,
-                 output_dir: Optional[str] = None, verbose: bool = False):
-        self.schema_path = Path(schema_path)
-        self.compare_path = Path(compare_path) if compare_path else None
-        self.output_dir = Path(output_dir) if output_dir else None
-        self.verbose = verbose
-        self.parser = SQLParser()
-
-    def run(self, mode: str = 'analyze') -> Dict:
-        """Execute the tool in specified mode."""
-        print(f"Database Migration Tool")
-        print(f"Schema: {self.schema_path}")
-        print("-" * 50)
-
-        if not self.schema_path.exists():
-            raise FileNotFoundError(f"Schema file not found: {self.schema_path}")
-
-        schema_sql = self.schema_path.read_text()
-        tables = self.parser.parse(schema_sql)
-
-        if self.verbose:
-            print(f"Parsed {len(tables)} tables")
-
-        if mode == 'analyze':
-            return self._analyze(tables)
-        elif mode == 'compare':
-            return self._compare(tables)
-        elif mode == 'suggest-indexes':
-            return self._suggest_indexes(tables)
-        else:
-            raise ValueError(f"Unknown mode: {mode}")
-
-    def _analyze(self, tables: Dict[str, Table]) -> Dict:
-        """Analyze schema for issues."""
-        analyzer = SchemaAnalyzer(tables)
-        issues = analyzer.analyze()
-
-        # Group by severity
-        errors = [i for i in issues if i.severity == 'error']
-        warnings = [i for i in issues if i.severity == 'warning']
-        infos = [i for i in issues if i.severity == 'info']
-
-        print(f"\nAnalysis Results:")
-        print(f"  Tables: {len(tables)}")
-        print(f"  Errors: {len(errors)}")
-        print(f"  Warnings: {len(warnings)}")
-        print(f"  Suggestions: {len(infos)}")
-
-        if errors:
-            print(f"\nERRORS:")
-            for issue in errors:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    Suggestion: {issue.suggestion}")
-
-        if warnings:
-            print(f"\nWARNINGS:")
-            for issue in warnings:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    Suggestion: {issue.suggestion}")
-
-        if self.verbose and infos:
-            print(f"\nSUGGESTIONS:")
-            for issue in infos:
-                print(f"  [{issue.table}] {issue.message}")
-                if issue.suggestion:
-                    print(f"    {issue.suggestion}")
-
-        return {
-            'status': 'success',
-            'tables_count': len(tables),
-            'issues': {
-                'errors': len(errors),
-                'warnings': len(warnings),
-                'suggestions': len(infos),
-            },
-            'issues_detail': [asdict(i) for i in issues],
-        }
-
-    def _compare(self, old_tables: Dict[str, Table]) -> Dict:
-        """Compare two schemas and generate migration."""
-        if not self.compare_path:
-            raise ValueError("Compare path required for compare mode")
-
-        if not self.compare_path.exists():
-            raise FileNotFoundError(f"Compare file not found: {self.compare_path}")
-
-        new_sql = self.compare_path.read_text()
-        new_tables = self.parser.parse(new_sql)
-
-        generator = MigrationGenerator(old_tables, new_tables)
-        up_sql, down_sql = generator.generate()
-
-        print(f"\nComparing schemas:")
-        print(f"  Old: {self.schema_path}")
-        print(f"  New: {self.compare_path}")
-
-        # Calculate changes
-        added_tables = set(new_tables.keys()) - set(old_tables.keys())
-        removed_tables = set(old_tables.keys()) - set(new_tables.keys())
-
-        print(f"\nChanges detected:")
-        print(f"  Added tables: {len(added_tables)}")
-        print(f"  Removed tables: {len(removed_tables)}")
-
-        if self.output_dir:
-            self.output_dir.mkdir(parents=True, exist_ok=True)
-            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
-
-            up_file = self.output_dir / f"{timestamp}_migration.sql"
-            down_file = self.output_dir / f"{timestamp}_migration_rollback.sql"
-
-            up_file.write_text(f"-- Migration: {self.schema_path} -> {self.compare_path}\n"
-                              f"-- Generated: {datetime.now().isoformat()}\n\n"
-                              f"BEGIN;\n\n{up_sql}\n\nCOMMIT;\n")
-
-            down_file.write_text(f"-- Rollback for migration {timestamp}\n"
-                                f"-- Generated: {datetime.now().isoformat()}\n\n"
-                                f"BEGIN;\n\n{down_sql}\n\nCOMMIT;\n")
-
-            print(f"\nGenerated files:")
-            print(f"  Migration: {up_file}")
-            print(f"  Rollback: {down_file}")
-        else:
-            print(f"\n--- UP MIGRATION ---")
-            print(up_sql)
-            print(f"\n--- DOWN MIGRATION ---")
-            print(down_sql)
-
-        return {
-            'status': 'success',
-            'added_tables': list(added_tables),
-            'removed_tables': list(removed_tables),
-            'up_sql': up_sql,
-            'down_sql': down_sql,
-        }
-
-    def _suggest_indexes(self, tables: Dict[str, Table]) -> Dict:
-        """Generate index suggestions."""
-        suggestions = []
-
-        for table_name, table in tables.items():
-            # Get existing indexed columns
-            indexed = set()
-            for idx in table.indexes:
-                indexed.update(idx.columns)
-            indexed.update(table.primary_key)
-
-            # Suggest indexes for foreign keys
-            for fk in table.foreign_keys:
-                if fk['column'] not in indexed:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': fk['column'],
-                        'reason': 'Foreign key',
-                        'sql': f"CREATE INDEX idx_{table_name}_{fk['column']} ON {table_name}({fk['column']});"
-                    })
-
-            # Suggest indexes for common patterns
-            for col_name in table.columns:
-                if col_name in indexed:
-                    continue
-
-                col_lower = col_name.lower()
-
-                # Foreign key pattern
-                if col_name.endswith('_id') and col_name not in indexed:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Likely foreign key',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name});"
-                    })
-
-                # Status/type columns
-                elif col_lower in ['status', 'state', 'type', 'category']:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Common filter column',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name});"
-                    })
-
-                # Timestamp columns
-                elif col_lower in ['created_at', 'updated_at']:
-                    suggestions.append({
-                        'table': table_name,
-                        'column': col_name,
-                        'reason': 'Common sort column',
-                        'sql': f"CREATE INDEX idx_{table_name}_{col_name} ON {table_name}({col_name} DESC);"
-                    })
-
-        print(f"\nIndex Suggestions ({len(suggestions)} found):")
-        for s in suggestions:
-            print(f"\n  [{s['table']}.{s['column']}] {s['reason']}")
-            print(f"    {s['sql']}")
-
-        if self.output_dir:
-            self.output_dir.mkdir(parents=True, exist_ok=True)
-            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
-            output_file = self.output_dir / f"{timestamp}_add_indexes.sql"
-
-            lines = [
-                f"-- Suggested indexes",
-                f"-- Generated: {datetime.now().isoformat()}",
-                "",
-            ]
-            for s in suggestions:
-                lines.append(f"-- {s['table']}.{s['column']}: {s['reason']}")
-                lines.append(s['sql'])
-                lines.append("")
-
-            output_file.write_text('\n'.join(lines))
-            print(f"\nWritten to: {output_file}")
-
-        return {
-            'status': 'success',
-            'suggestions_count': len(suggestions),
-            'suggestions': suggestions,
-        }
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description='Analyze SQL schemas and generate migrations',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  %(prog)s schema.sql --analyze
-  %(prog)s old.sql --compare new.sql --output migrations/
-  %(prog)s schema.sql --suggest-indexes --output migrations/
-        '''
-    )
-
-    parser.add_argument(
-        'schema',
-        help='Path to SQL schema file'
-    )
-    parser.add_argument(
-        '--analyze',
-        action='store_true',
-        help='Analyze schema for issues and optimizations'
-    )
-    parser.add_argument(
-        '--compare',
-        metavar='FILE',
-        help='Compare with another schema file and generate migration'
-    )
-    parser.add_argument(
-        '--suggest-indexes',
-        action='store_true',
-        help='Generate index suggestions'
-    )
-    parser.add_argument(
-        '--output', '-o',
-        help='Output directory for generated files'
-    )
-    parser.add_argument(
-        '--verbose', '-v',
-        action='store_true',
-        help='Enable verbose output'
-    )
-    parser.add_argument(
-        '--json',
-        action='store_true',
-        help='Output results as JSON'
-    )
-
-    args = parser.parse_args()
-
-    # Determine mode
-    if args.compare:
-        mode = 'compare'
-    elif args.suggest_indexes:
-        mode = 'suggest-indexes'
-    else:
-        mode = 'analyze'
-
-    try:
-        tool = DatabaseMigrationTool(
-            schema_path=args.schema,
-            compare_path=args.compare,
-            output_dir=args.output,
-            verbose=args.verbose,
-        )
-
-        results = tool.run(mode=mode)
-
-        if args.json:
-            print(json.dumps(results, indent=2))
-
-    except Exception as e:
-        print(f"Error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/.claude/skills/spring-boot-engineer/SKILL.md b/.claude/skills/spring-boot-engineer/SKILL.md
deleted file mode 100644
index 9ccba6c..0000000
--- a/.claude/skills/spring-boot-engineer/SKILL.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-name: spring-boot-engineer
-description: Use when building Spring Boot 3.x applications, microservices, or reactive Java applications. Invoke for Spring Data JPA, Spring Security 6, WebFlux, Spring Cloud integration.
-triggers:
-  - Spring Boot
-  - Spring Framework
-  - Spring Cloud
-  - Spring Security
-  - Spring Data JPA
-  - Spring WebFlux
-  - Microservices Java
-  - Java REST API
-  - Reactive Java
-role: specialist
-scope: implementation
-output-format: code
----
-
-# Spring Boot Engineer
-
-Senior Spring Boot engineer with expertise in Spring Boot 3+, cloud-native Java development, and enterprise microservices architecture.
-
-## Role Definition
-
-You are a senior Spring Boot engineer with 10+ years of enterprise Java experience. You specialize in Spring Boot 3.x with Java 17+, reactive programming, Spring Cloud ecosystem, and building production-grade microservices. You focus on creating scalable, secure, and maintainable applications with comprehensive testing and observability.
-
-## When to Use This Skill
-
-- Building REST APIs with Spring Boot
-- Implementing reactive applications with WebFlux
-- Setting up Spring Data JPA repositories
-- Implementing Spring Security 6 authentication
-- Creating microservices with Spring Cloud
-- Optimizing Spring Boot performance
-- Writing comprehensive tests with Spring Boot Test
-
-## Core Workflow
-
-1. **Analyze requirements** - Identify service boundaries, APIs, data models, security needs
-2. **Design architecture** - Plan microservices, data access, cloud integration, security
-3. **Implement** - Create services with proper dependency injection and layered architecture
-4. **Secure** - Add Spring Security, OAuth2, method security, CORS configuration
-5. **Test** - Write unit, integration, and slice tests with high coverage
-6. **Deploy** - Configure for cloud deployment with health checks and observability
-
-## Reference Guide
-
-Load detailed guidance based on context:
-
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| Web Layer | `references/web.md` | Controllers, REST APIs, validation, exception handling |
-| Data Access | `references/data.md` | Spring Data JPA, repositories, transactions, projections |
-| Security | `references/security.md` | Spring Security 6, OAuth2, JWT, method security |
-| Cloud Native | `references/cloud.md` | Spring Cloud, Config, Discovery, Gateway, resilience |
-| Testing | `references/testing.md` | @SpringBootTest, MockMvc, Testcontainers, test slices |
-
-## Constraints
-
-### MUST DO
-- Use Spring Boot 3.x with Java 17+ features
-- Apply dependency injection via constructor injection
-- Use @RestController for REST APIs with proper HTTP methods
-- Implement validation with @Valid and constraint annotations
-- Use Spring Data repositories for data access
-- Apply @Transactional appropriately for transaction management
-- Write tests with @SpringBootTest and test slices
-- Configure application.yml/properties properly
-- Use @ConfigurationProperties for type-safe configuration
-- Implement proper exception handling with @ControllerAdvice
-
-### MUST NOT DO
-- Use field injection (@Autowired on fields)
-- Skip input validation on API endpoints
-- Expose internal exceptions to API clients
-- Use @Component when @Service/@Repository/@Controller applies
-- Mix blocking and reactive code improperly
-- Store secrets in application.properties
-- Skip transaction management for multi-step operations
-- Use deprecated Spring Boot 2.x patterns
-- Hardcode URLs, credentials, or configuration
-
-## Output Templates
-
-When implementing Spring Boot features, provide:
-1. Entity/model classes with JPA annotations
-2. Repository interfaces extending Spring Data
-3. Service layer with business logic
-4. Controller with REST endpoints
-5. DTO classes for API requests/responses
-6. Configuration classes if needed
-7. Test classes with appropriate test slices
-8. Brief explanation of architecture decisions
-
-## Knowledge Reference
-
-Spring Boot 3.x, Spring Framework 6, Spring Data JPA, Spring Security 6, Spring Cloud, Project Reactor (WebFlux), JPA/Hibernate, Bean Validation, RestTemplate/WebClient, Actuator, Micrometer, JUnit 5, Mockito, Testcontainers, Docker, Kubernetes
-
-## Related Skills
-
-- **Java Architect** - Enterprise Java patterns and architecture
-- **Database Optimizer** - JPA optimization and query tuning
-- **Microservices Architect** - Service boundaries and patterns
-- **DevOps Engineer** - Deployment and containerization
diff --git a/.claude/skills/spring-boot-engineer/references/cloud.md b/.claude/skills/spring-boot-engineer/references/cloud.md
deleted file mode 100644
index 7be0b16..0000000
--- a/.claude/skills/spring-boot-engineer/references/cloud.md
+++ /dev/null
@@ -1,498 +0,0 @@
-# Cloud Native - Spring Cloud
-
-## Spring Cloud Config Server
-
-```java
-// Config Server
-@SpringBootApplication
-@EnableConfigServer
-public class ConfigServerApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(ConfigServerApplication.class, args);
-    }
-}
-
-// application.yml
-server:
-  port: 8888
-
-spring:
-  cloud:
-    config:
-      server:
-        git:
-          uri: https://github.com/example/config-repo
-          default-label: main
-          search-paths: '{application}'
-          username: ${GIT_USERNAME}
-          password: ${GIT_PASSWORD}
-        native:
-          search-locations: classpath:/config
-  security:
-    user:
-      name: config-user
-      password: ${CONFIG_PASSWORD}
-
-// Config Client
-@SpringBootApplication
-public class ClientApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(ClientApplication.class, args);
-    }
-}
-
-// application.yml (Config Client)
-spring:
-  application:
-    name: user-service
-  config:
-    import: "configserver:http://localhost:8888"
-  cloud:
-    config:
-      username: config-user
-      password: ${CONFIG_PASSWORD}
-      fail-fast: true
-      retry:
-        max-attempts: 6
-        initial-interval: 1000
-```
-
-## Dynamic Configuration Refresh
-
-```java
-@RestController
-@RefreshScope
-public class ConfigController {
-    @Value("${app.feature.enabled:false}")
-    private boolean featureEnabled;
-
-    @Value("${app.max-connections:100}")
-    private int maxConnections;
-
-    @GetMapping("/config")
-    public Map<String, Object> getConfig() {
-        return Map.of(
-            "featureEnabled", featureEnabled,
-            "maxConnections", maxConnections
-        );
-    }
-}
-
-// Refresh configuration via Actuator endpoint:
-// POST /actuator/refresh
-```
-
-## Service Discovery - Eureka
-
-```java
-// Eureka Server
-@SpringBootApplication
-@EnableEurekaServer
-public class EurekaServerApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(EurekaServerApplication.class, args);
-    }
-}
-
-// application.yml (Eureka Server)
-server:
-  port: 8761
-
-eureka:
-  instance:
-    hostname: localhost
-  client:
-    register-with-eureka: false
-    fetch-registry: false
-    service-url:
-      defaultZone: http://${eureka.instance.hostname}:${server.port}/eureka/
-
-// Eureka Client
-@SpringBootApplication
-@EnableDiscoveryClient
-public class UserServiceApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(UserServiceApplication.class, args);
-    }
-}
-
-// application.yml (Eureka Client)
-spring:
-  application:
-    name: user-service
-
-eureka:
-  client:
-    service-url:
-      defaultZone: http://localhost:8761/eureka/
-    registry-fetch-interval-seconds: 5
-  instance:
-    prefer-ip-address: true
-    lease-renewal-interval-in-seconds: 10
-    lease-expiration-duration-in-seconds: 30
-```
-
-## Spring Cloud Gateway
-
-```java
-@SpringBootApplication
-public class GatewayApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(GatewayApplication.class, args);
-    }
-
-    @Bean
-    public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
-        return builder.routes()
-            .route("user-service", r -> r
-                .path("/api/users/**")
-                .filters(f -> f
-                    .rewritePath("/api/users/(?<segment>.*)", "/users/${segment}")
-                    .addRequestHeader("X-Gateway", "Spring-Cloud-Gateway")
-                    .circuitBreaker(config -> config
-                        .setName("userServiceCircuitBreaker")
-                        .setFallbackUri("forward:/fallback/users")
-                    )
-                    .retry(config -> config
-                        .setRetries(3)
-                        .setStatuses(HttpStatus.SERVICE_UNAVAILABLE)
-                    )
-                )
-                .uri("lb://user-service")
-            )
-            .route("order-service", r -> r
-                .path("/api/orders/**")
-                .filters(f -> f
-                    .rewritePath("/api/orders/(?<segment>.*)", "/orders/${segment}")
-                    .requestRateLimiter(config -> config
-                        .setRateLimiter(redisRateLimiter())
-                        .setKeyResolver(userKeyResolver())
-                    )
-                )
-                .uri("lb://order-service")
-            )
-            .build();
-    }
-
-    @Bean
-    public RedisRateLimiter redisRateLimiter() {
-        return new RedisRateLimiter(10, 20); // replenishRate, burstCapacity
-    }
-
-    @Bean
-    public KeyResolver userKeyResolver() {
-        return exchange -> Mono.just(
-            exchange.getRequest().getHeaders().getFirst("X-User-Id")
-        );
-    }
-}
-
-// application.yml (Gateway)
-spring:
-  cloud:
-    gateway:
-      discovery:
-        locator:
-          enabled: true
-          lower-case-service-id: true
-      default-filters:
-        - DedupeResponseHeader=Access-Control-Allow-Origin
-      globalcors:
-        cors-configurations:
-          '[/**]':
-            allowed-origins: "*"
-            allowed-methods:
-              - GET
-              - POST
-              - PUT
-              - DELETE
-            allowed-headers: "*"
-```
-
-## Circuit Breaker - Resilience4j
-
-```java
-@Service
-@RequiredArgsConstructor
-public class ExternalApiService {
-    private final WebClient webClient;
-
-    @CircuitBreaker(name = "externalApi", fallbackMethod = "getFallbackData")
-    @Retry(name = "externalApi")
-    @RateLimiter(name = "externalApi")
-    public Mono<ExternalData> getData(String id) {
-        return webClient
-            .get()
-            .uri("/data/{id}", id)
-            .retrieve()
-            .bodyToMono(ExternalData.class)
-            .timeout(Duration.ofSeconds(3));
-    }
-
-    private Mono<ExternalData> getFallbackData(String id, Exception e) {
-        log.warn("Fallback triggered for id: {}, error: {}", id, e.getMessage());
-        return Mono.just(new ExternalData(id, "Fallback data", LocalDateTime.now()));
-    }
-}
-
-// application.yml
-resilience4j:
-  circuitbreaker:
-    instances:
-      externalApi:
-        register-health-indicator: true
-        sliding-window-size: 10
-        minimum-number-of-calls: 5
-        permitted-number-of-calls-in-half-open-state: 3
-        automatic-transition-from-open-to-half-open-enabled: true
-        wait-duration-in-open-state: 5s
-        failure-rate-threshold: 50
-        event-consumer-buffer-size: 10
-
-  retry:
-    instances:
-      externalApi:
-        max-attempts: 3
-        wait-duration: 1s
-        enable-exponential-backoff: true
-        exponential-backoff-multiplier: 2
-
-  ratelimiter:
-    instances:
-      externalApi:
-        limit-for-period: 10
-        limit-refresh-period: 1s
-        timeout-duration: 0s
-```
-
-## Distributed Tracing - Micrometer Tracing
-
-```java
-// application.yml
-management:
-  tracing:
-    sampling:
-      probability: 1.0
-  zipkin:
-    tracing:
-      endpoint: http://localhost:9411/api/v2/spans
-
-logging:
-  pattern:
-    level: "%5p [${spring.application.name:},%X{traceId:-},%X{spanId:-}]"
-
-// Custom spans
-@Service
-@RequiredArgsConstructor
-public class OrderService {
-    private final Tracer tracer;
-    private final OrderRepository orderRepository;
-
-    public Order processOrder(OrderRequest request) {
-        Span span = tracer.nextSpan().name("processOrder").start();
-        try (Tracer.SpanInScope ws = tracer.withSpan(span)) {
-            span.tag("order.type", request.type());
-            span.tag("order.items", String.valueOf(request.items().size()));
-
-            // Business logic
-            Order order = createOrder(request);
-
-            span.event("order.created");
-            return order;
-        } finally {
-            span.end();
-        }
-    }
-}
-```
-
-## Load Balancing with Spring Cloud LoadBalancer
-
-```java
-@Configuration
-@LoadBalancerClient(name = "user-service", configuration = UserServiceLoadBalancerConfig.class)
-public class LoadBalancerConfiguration {
-}
-
-@Configuration
-public class UserServiceLoadBalancerConfig {
-
-    @Bean
-    public ReactorLoadBalancer<ServiceInstance> randomLoadBalancer(
-            LoadBalancerClientFactory clientFactory,
-            ObjectProvider<LoadBalancerProperties> properties) {
-        return new RandomLoadBalancer(
-            clientFactory.getLazyProvider("user-service", ServiceInstanceListSupplier.class),
-            "user-service"
-        );
-    }
-}
-
-@Service
-@RequiredArgsConstructor
-public class UserClientService {
-    private final WebClient.Builder webClientBuilder;
-
-    public Mono<User> getUser(Long id) {
-        return webClientBuilder
-            .baseUrl("http://user-service")
-            .build()
-            .get()
-            .uri("/users/{id}", id)
-            .retrieve()
-            .bodyToMono(User.class);
-    }
-}
-```
-
-## Health Checks & Actuator
-
-```java
-@Component
-public class CustomHealthIndicator implements HealthIndicator {
-
-    @Override
-    public Health health() {
-        boolean serviceUp = checkExternalService();
-
-        if (serviceUp) {
-            return Health.up()
-                .withDetail("externalService", "Available")
-                .withDetail("timestamp", LocalDateTime.now())
-                .build();
-        } else {
-            return Health.down()
-                .withDetail("externalService", "Unavailable")
-                .withDetail("error", "Connection timeout")
-                .build();
-        }
-    }
-
-    private boolean checkExternalService() {
-        // Check external dependency
-        return true;
-    }
-}
-
-// application.yml
-management:
-  endpoints:
-    web:
-      exposure:
-        include: health,info,metrics,prometheus
-  endpoint:
-    health:
-      show-details: always
-      probes:
-        enabled: true
-  health:
-    livenessState:
-      enabled: true
-    readinessState:
-      enabled: true
-  metrics:
-    export:
-      prometheus:
-        enabled: true
-    tags:
-      application: ${spring.application.name}
-```
-
-## Kubernetes Deployment
-
-```yaml
-# deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: user-service
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: user-service
-  template:
-    metadata:
-      labels:
-        app: user-service
-    spec:
-      containers:
-      - name: user-service
-        image: user-service:1.0.0
-        ports:
-        - containerPort: 8080
-        env:
-        - name: SPRING_PROFILES_ACTIVE
-          value: "kubernetes"
-        - name: JAVA_OPTS
-          value: "-Xmx512m -Xms256m"
-        livenessProbe:
-          httpGet:
-            path: /actuator/health/liveness
-            port: 8080
-          initialDelaySeconds: 60
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /actuator/health/readiness
-            port: 8080
-          initialDelaySeconds: 30
-          periodSeconds: 5
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "1Gi"
-            cpu: "1000m"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: user-service
-spec:
-  selector:
-    app: user-service
-  ports:
-  - port: 80
-    targetPort: 8080
-  type: ClusterIP
-```
-
-## Docker Configuration
-
-```dockerfile
-# Dockerfile (Multi-stage)
-FROM eclipse-temurin:17-jdk-alpine AS build
-WORKDIR /workspace/app
-
-COPY mvnw .
-COPY .mvn .mvn
-COPY pom.xml .
-COPY src src
-
-RUN ./mvnw install -DskipTests
-RUN mkdir -p target/dependency && (cd target/dependency; jar -xf ../*.jar)
-
-FROM eclipse-temurin:17-jre-alpine
-VOLUME /tmp
-ARG DEPENDENCY=/workspace/app/target/dependency
-COPY --from=build ${DEPENDENCY}/BOOT-INF/lib /app/lib
-COPY --from=build ${DEPENDENCY}/META-INF /app/META-INF
-COPY --from=build ${DEPENDENCY}/BOOT-INF/classes /app
-
-ENTRYPOINT ["java","-cp","app:app/lib/*","com.example.Application"]
-```
-
-## Quick Reference
-
-| Component | Purpose |
-|-----------|---------|
-| **Config Server** | Centralized configuration management |
-| **Eureka** | Service discovery and registration |
-| **Gateway** | API gateway with routing, filtering, load balancing |
-| **Circuit Breaker** | Fault tolerance and fallback patterns |
-| **Load Balancer** | Client-side load balancing |
-| **Tracing** | Distributed tracing across services |
-| **Actuator** | Production-ready monitoring and management |
-| **Kubernetes** | Container orchestration and deployment |
diff --git a/.claude/skills/spring-boot-engineer/references/data.md b/.claude/skills/spring-boot-engineer/references/data.md
deleted file mode 100644
index f7643b2..0000000
--- a/.claude/skills/spring-boot-engineer/references/data.md
+++ /dev/null
@@ -1,381 +0,0 @@
-# Data Access - Spring Data JPA
-
-## JPA Entity Pattern
-
-```java
-@Entity
-@Table(name = "users", indexes = {
-    @Index(name = "idx_email", columnList = "email", unique = true),
-    @Index(name = "idx_username", columnList = "username")
-})
-@EntityListeners(AuditingEntityListener.class)
-@Getter @Setter
-@NoArgsConstructor
-@AllArgsConstructor
-@Builder
-public class User {
-
-    @Id
-    @GeneratedValue(strategy = GenerationType.IDENTITY)
-    private Long id;
-
-    @Column(nullable = false, unique = true, length = 100)
-    private String email;
-
-    @Column(nullable = false, length = 100)
-    private String password;
-
-    @Column(nullable = false, unique = true, length = 50)
-    private String username;
-
-    @Column(nullable = false)
-    @Builder.Default
-    private Boolean active = true;
-
-    @OneToMany(mappedBy = "user", cascade = CascadeType.ALL, orphanRemoval = true)
-    @Builder.Default
-    private List<Address> addresses = new ArrayList<>();
-
-    @ManyToMany
-    @JoinTable(
-        name = "user_roles",
-        joinColumns = @JoinColumn(name = "user_id"),
-        inverseJoinColumns = @JoinColumn(name = "role_id")
-    )
-    @Builder.Default
-    private Set<Role> roles = new HashSet<>();
-
-    @CreatedDate
-    @Column(nullable = false, updatable = false)
-    private LocalDateTime createdAt;
-
-    @LastModifiedDate
-    @Column(nullable = false)
-    private LocalDateTime updatedAt;
-
-    @Version
-    private Long version;
-
-    // Helper methods for bidirectional relationships
-    public void addAddress(Address address) {
-        addresses.add(address);
-        address.setUser(this);
-    }
-
-    public void removeAddress(Address address) {
-        addresses.remove(address);
-        address.setUser(null);
-    }
-}
-```
-
-## Spring Data JPA Repository
-
-```java
-@Repository
-public interface UserRepository extends JpaRepository<User, Long>,
-                                       JpaSpecificationExecutor<User> {
-
-    Optional<User> findByEmail(String email);
-
-    Optional<User> findByUsername(String username);
-
-    boolean existsByEmail(String email);
-
-    boolean existsByUsername(String username);
-
-    @Query("SELECT u FROM User u LEFT JOIN FETCH u.roles WHERE u.email = :email")
-    Optional<User> findByEmailWithRoles(@Param("email") String email);
-
-    @Query("SELECT u FROM User u WHERE u.active = true AND u.createdAt >= :since")
-    List<User> findActiveUsersSince(@Param("since") LocalDateTime since);
-
-    @Modifying
-    @Query("UPDATE User u SET u.active = false WHERE u.lastLoginAt < :threshold")
-    int deactivateInactiveUsers(@Param("threshold") LocalDateTime threshold);
-
-    // Projection for read-only DTOs
-    @Query("SELECT new com.example.dto.UserSummary(u.id, u.username, u.email) " +
-           "FROM User u WHERE u.active = true")
-    List<UserSummary> findAllActiveSummaries();
-}
-```
-
-## Repository with Specifications
-
-```java
-public class UserSpecifications {
-
-    public static Specification<User> hasEmail(String email) {
-        return (root, query, cb) ->
-            email == null ? null : cb.equal(root.get("email"), email);
-    }
-
-    public static Specification<User> isActive() {
-        return (root, query, cb) -> cb.isTrue(root.get("active"));
-    }
-
-    public static Specification<User> createdAfter(LocalDateTime date) {
-        return (root, query, cb) ->
-            date == null ? null : cb.greaterThanOrEqualTo(root.get("createdAt"), date);
-    }
-
-    public static Specification<User> hasRole(String roleName) {
-        return (root, query, cb) -> {
-            Join<User, Role> roles = root.join("roles", JoinType.INNER);
-            return cb.equal(roles.get("name"), roleName);
-        };
-    }
-}
-
-// Usage in service
-@Service
-@RequiredArgsConstructor
-public class UserService {
-    private final UserRepository userRepository;
-
-    public Page<User> searchUsers(UserSearchCriteria criteria, Pageable pageable) {
-        Specification<User> spec = Specification
-            .where(UserSpecifications.hasEmail(criteria.email()))
-            .and(UserSpecifications.isActive())
-            .and(UserSpecifications.createdAfter(criteria.createdAfter()));
-
-        return userRepository.findAll(spec, pageable);
-    }
-}
-```
-
-## Transaction Management
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional(readOnly = true)
-public class OrderService {
-    private final OrderRepository orderRepository;
-    private final PaymentService paymentService;
-    private final InventoryService inventoryService;
-    private final NotificationService notificationService;
-
-    @Transactional
-    public Order createOrder(OrderCreateRequest request) {
-        // All operations in single transaction
-        Order order = Order.builder()
-            .customerId(request.customerId())
-            .status(OrderStatus.PENDING)
-            .build();
-
-        request.items().forEach(item -> {
-            inventoryService.reserveStock(item.productId(), item.quantity());
-            order.addItem(item);
-        });
-
-        order = orderRepository.save(order);
-
-        try {
-            paymentService.processPayment(order);
-            order.setStatus(OrderStatus.PAID);
-        } catch (PaymentException e) {
-            order.setStatus(OrderStatus.PAYMENT_FAILED);
-            throw e; // Transaction will rollback
-        }
-
-        return orderRepository.save(order);
-    }
-
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public void logOrderEvent(Long orderId, String event) {
-        // Separate transaction - will commit even if parent rolls back
-        OrderEvent orderEvent = new OrderEvent(orderId, event);
-        orderEventRepository.save(orderEvent);
-    }
-
-    @Transactional(noRollbackFor = NotificationException.class)
-    public void completeOrder(Long orderId) {
-        Order order = orderRepository.findById(orderId)
-            .orElseThrow(() -> new ResourceNotFoundException("Order not found"));
-
-        order.setStatus(OrderStatus.COMPLETED);
-        orderRepository.save(order);
-
-        // Won't rollback transaction if notification fails
-        try {
-            notificationService.sendCompletionEmail(order);
-        } catch (NotificationException e) {
-            log.error("Failed to send notification for order {}", orderId, e);
-        }
-    }
-}
-```
-
-## Auditing Configuration
-
-```java
-@Configuration
-@EnableJpaAuditing
-public class JpaAuditingConfig {
-
-    @Bean
-    public AuditorAware<String> auditorProvider() {
-        return () -> {
-            Authentication authentication = SecurityContextHolder
-                .getContext()
-                .getAuthentication();
-
-            if (authentication == null || !authentication.isAuthenticated()) {
-                return Optional.of("system");
-            }
-
-            return Optional.of(authentication.getName());
-        };
-    }
-}
-
-@MappedSuperclass
-@EntityListeners(AuditingEntityListener.class)
-@Getter @Setter
-public abstract class AuditableEntity {
-
-    @CreatedDate
-    @Column(nullable = false, updatable = false)
-    private LocalDateTime createdAt;
-
-    @CreatedBy
-    @Column(nullable = false, updatable = false, length = 100)
-    private String createdBy;
-
-    @LastModifiedDate
-    @Column(nullable = false)
-    private LocalDateTime updatedAt;
-
-    @LastModifiedBy
-    @Column(nullable = false, length = 100)
-    private String updatedBy;
-}
-```
-
-## Projections
-
-```java
-// Interface-based projection
-public interface UserSummary {
-    Long getId();
-    String getUsername();
-    String getEmail();
-
-    @Value("#{target.firstName + ' ' + target.lastName}")
-    String getFullName();
-}
-
-// Class-based projection (DTO)
-public record UserSummaryDto(
-    Long id,
-    String username,
-    String email
-) {}
-
-// Usage
-public interface UserRepository extends JpaRepository<User, Long> {
-    List<UserSummary> findAllBy();
-
-    <T> List<T> findAllBy(Class<T> type);
-}
-
-// Service usage
-List<UserSummary> summaries = userRepository.findAllBy();
-List<UserSummaryDto> dtos = userRepository.findAllBy(UserSummaryDto.class);
-```
-
-## Query Optimization
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional(readOnly = true)
-public class UserQueryService {
-    private final UserRepository userRepository;
-    private final EntityManager entityManager;
-
-    // N+1 problem solved with JOIN FETCH
-    @Query("SELECT DISTINCT u FROM User u " +
-           "LEFT JOIN FETCH u.addresses " +
-           "LEFT JOIN FETCH u.roles " +
-           "WHERE u.active = true")
-    List<User> findAllActiveWithAssociations();
-
-    // Batch fetching
-    @BatchSize(size = 25)
-    @OneToMany(mappedBy = "user")
-    private List<Order> orders;
-
-    // EntityGraph for dynamic fetching
-    @EntityGraph(attributePaths = {"addresses", "roles"})
-    List<User> findAllByActiveTrue();
-
-    // Pagination to avoid loading all data
-    public Page<User> findAllUsers(Pageable pageable) {
-        return userRepository.findAll(pageable);
-    }
-
-    // Native query for complex queries
-    @Query(value = """
-        SELECT u.* FROM users u
-        INNER JOIN orders o ON u.id = o.user_id
-        WHERE o.created_at >= :since
-        GROUP BY u.id
-        HAVING COUNT(o.id) >= :minOrders
-        """, nativeQuery = true)
-    List<User> findFrequentBuyers(@Param("since") LocalDateTime since,
-                                  @Param("minOrders") int minOrders);
-}
-```
-
-## Database Migrations (Flyway)
-
-```sql
--- V1__create_users_table.sql
-CREATE TABLE users (
-    id BIGSERIAL PRIMARY KEY,
-    email VARCHAR(100) NOT NULL UNIQUE,
-    password VARCHAR(100) NOT NULL,
-    username VARCHAR(50) NOT NULL UNIQUE,
-    active BOOLEAN NOT NULL DEFAULT true,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version BIGINT NOT NULL DEFAULT 0
-);
-
-CREATE INDEX idx_users_email ON users(email);
-CREATE INDEX idx_users_username ON users(username);
-CREATE INDEX idx_users_active ON users(active);
-
--- V2__create_addresses_table.sql
-CREATE TABLE addresses (
-    id BIGSERIAL PRIMARY KEY,
-    user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    street VARCHAR(200) NOT NULL,
-    city VARCHAR(100) NOT NULL,
-    country VARCHAR(2) NOT NULL,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX idx_addresses_user_id ON addresses(user_id);
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@Entity` | Marks class as JPA entity |
-| `@Table` | Specifies table details and indexes |
-| `@Id` | Marks primary key field |
-| `@GeneratedValue` | Auto-generated primary key strategy |
-| `@Column` | Column constraints and mapping |
-| `@OneToMany/@ManyToOne` | One-to-many/many-to-one relationships |
-| `@ManyToMany` | Many-to-many relationships |
-| `@JoinColumn/@JoinTable` | Join column/table configuration |
-| `@Transactional` | Declares transaction boundaries |
-| `@Query` | Custom JPQL/native queries |
-| `@Modifying` | Marks query as UPDATE/DELETE |
-| `@EntityGraph` | Defines fetch graph for associations |
-| `@Version` | Optimistic locking version field |
diff --git a/.claude/skills/spring-boot-engineer/references/security.md b/.claude/skills/spring-boot-engineer/references/security.md
deleted file mode 100644
index 9a4bfa3..0000000
--- a/.claude/skills/spring-boot-engineer/references/security.md
+++ /dev/null
@@ -1,459 +0,0 @@
-# Security - Spring Security 6
-
-## Security Configuration
-
-```java
-@Configuration
-@EnableWebSecurity
-@EnableMethodSecurity
-public class SecurityConfig {
-
-    @Bean
-    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-        http
-            .csrf(csrf -> csrf
-                .ignoringRequestMatchers("/api/auth/**")
-                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
-            )
-            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
-            .authorizeHttpRequests(auth -> auth
-                .requestMatchers("/api/auth/**", "/actuator/health").permitAll()
-                .requestMatchers("/api/admin/**").hasRole("ADMIN")
-                .requestMatchers("/api/users/**").hasAnyRole("USER", "ADMIN")
-                .anyRequest().authenticated()
-            )
-            .sessionManagement(session -> session
-                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-            )
-            .exceptionHandling(ex -> ex
-                .authenticationEntryPoint(authenticationEntryPoint())
-                .accessDeniedHandler(accessDeniedHandler())
-            )
-            .addFilterBefore(jwtAuthenticationFilter(),
-                           UsernamePasswordAuthenticationFilter.class);
-
-        return http.build();
-    }
-
-    @Bean
-    public CorsConfigurationSource corsConfigurationSource() {
-        CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
-        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
-        configuration.setAllowedHeaders(List.of("*"));
-        configuration.setAllowCredentials(true);
-        configuration.setMaxAge(3600L);
-
-        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        source.registerCorsConfiguration("/**", configuration);
-        return source;
-    }
-
-    @Bean
-    public AuthenticationManager authenticationManager(
-            AuthenticationConfiguration config) throws Exception {
-        return config.getAuthenticationManager();
-    }
-
-    @Bean
-    public PasswordEncoder passwordEncoder() {
-        return new BCryptPasswordEncoder(12);
-    }
-}
-```
-
-## JWT Authentication Filter
-
-```java
-@Component
-@RequiredArgsConstructor
-public class JwtAuthenticationFilter extends OncePerRequestFilter {
-    private final JwtService jwtService;
-    private final UserDetailsService userDetailsService;
-
-    @Override
-    protected void doFilterInternal(
-            @NonNull HttpServletRequest request,
-            @NonNull HttpServletRequest response,
-            @NonNull FilterChain filterChain) throws ServletException, IOException {
-
-        final String authHeader = request.getHeader("Authorization");
-        final String jwt;
-        final String username;
-
-        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
-            filterChain.doFilter(request, response);
-            return;
-        }
-
-        jwt = authHeader.substring(7);
-
-        try {
-            username = jwtService.extractUsername(jwt);
-
-            if (username != null && SecurityContextHolder.getContext()
-                    .getAuthentication() == null) {
-                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
-
-                if (jwtService.isTokenValid(jwt, userDetails)) {
-                    UsernamePasswordAuthenticationToken authToken =
-                        new UsernamePasswordAuthenticationToken(
-                            userDetails,
-                            null,
-                            userDetails.getAuthorities()
-                        );
-
-                    authToken.setDetails(
-                        new WebAuthenticationDetailsSource().buildDetails(request)
-                    );
-
-                    SecurityContextHolder.getContext().setAuthentication(authToken);
-                }
-            }
-        } catch (JwtException e) {
-            log.error("JWT validation failed", e);
-        }
-
-        filterChain.doFilter(request, response);
-    }
-}
-```
-
-## JWT Service
-
-```java
-@Service
-public class JwtService {
-    @Value("${jwt.secret}")
-    private String secretKey;
-
-    @Value("${jwt.expiration}")
-    private long jwtExpiration;
-
-    @Value("${jwt.refresh-expiration}")
-    private long refreshExpiration;
-
-    public String extractUsername(String token) {
-        return extractClaim(token, Claims::getSubject);
-    }
-
-    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
-        final Claims claims = extractAllClaims(token);
-        return claimsResolver.apply(claims);
-    }
-
-    public String generateToken(UserDetails userDetails) {
-        Map<String, Object> extraClaims = new HashMap<>();
-        extraClaims.put("roles", userDetails.getAuthorities().stream()
-            .map(GrantedAuthority::getAuthority)
-            .collect(Collectors.toList()));
-
-        return generateToken(extraClaims, userDetails);
-    }
-
-    public String generateToken(
-            Map<String, Object> extraClaims,
-            UserDetails userDetails) {
-        return buildToken(extraClaims, userDetails, jwtExpiration);
-    }
-
-    public String generateRefreshToken(UserDetails userDetails) {
-        return buildToken(new HashMap<>(), userDetails, refreshExpiration);
-    }
-
-    private String buildToken(
-            Map<String, Object> extraClaims,
-            UserDetails userDetails,
-            long expiration) {
-        return Jwts
-            .builder()
-            .setClaims(extraClaims)
-            .setSubject(userDetails.getUsername())
-            .setIssuedAt(new Date(System.currentTimeMillis()))
-            .setExpiration(new Date(System.currentTimeMillis() + expiration))
-            .signWith(getSignInKey(), SignatureAlgorithm.HS256)
-            .compact();
-    }
-
-    public boolean isTokenValid(String token, UserDetails userDetails) {
-        final String username = extractUsername(token);
-        return username.equals(userDetails.getUsername()) && !isTokenExpired(token);
-    }
-
-    private boolean isTokenExpired(String token) {
-        return extractExpiration(token).before(new Date());
-    }
-
-    private Date extractExpiration(String token) {
-        return extractClaim(token, Claims::getExpiration);
-    }
-
-    private Claims extractAllClaims(String token) {
-        return Jwts
-            .parserBuilder()
-            .setSigningKey(getSignInKey())
-            .build()
-            .parseClaimsJws(token)
-            .getBody();
-    }
-
-    private Key getSignInKey() {
-        byte[] keyBytes = Decoders.BASE64.decode(secretKey);
-        return Keys.hmacShaKeyFor(keyBytes);
-    }
-}
-```
-
-## UserDetailsService Implementation
-
-```java
-@Service
-@RequiredArgsConstructor
-public class CustomUserDetailsService implements UserDetailsService {
-    private final UserRepository userRepository;
-
-    @Override
-    @Transactional(readOnly = true)
-    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
-        User user = userRepository.findByEmailWithRoles(username)
-            .orElseThrow(() -> new UsernameNotFoundException(
-                "User not found with email: " + username));
-
-        return org.springframework.security.core.userdetails.User
-            .builder()
-            .username(user.getEmail())
-            .password(user.getPassword())
-            .authorities(user.getRoles().stream()
-                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
-                .collect(Collectors.toList()))
-            .accountExpired(false)
-            .accountLocked(!user.getActive())
-            .credentialsExpired(false)
-            .disabled(!user.getActive())
-            .build();
-    }
-}
-```
-
-## Authentication Controller
-
-```java
-@RestController
-@RequestMapping("/api/auth")
-@RequiredArgsConstructor
-public class AuthenticationController {
-    private final AuthenticationService authenticationService;
-
-    @PostMapping("/register")
-    public ResponseEntity<AuthenticationResponse> register(
-            @Valid @RequestBody RegisterRequest request) {
-        AuthenticationResponse response = authenticationService.register(request);
-        return ResponseEntity.status(HttpStatus.CREATED).body(response);
-    }
-
-    @PostMapping("/login")
-    public ResponseEntity<AuthenticationResponse> login(
-            @Valid @RequestBody LoginRequest request) {
-        AuthenticationResponse response = authenticationService.login(request);
-        return ResponseEntity.ok(response);
-    }
-
-    @PostMapping("/refresh")
-    public ResponseEntity<AuthenticationResponse> refreshToken(
-            @RequestBody RefreshTokenRequest request) {
-        AuthenticationResponse response = authenticationService.refreshToken(request);
-        return ResponseEntity.ok(response);
-    }
-
-    @PostMapping("/logout")
-    @PreAuthorize("isAuthenticated()")
-    public ResponseEntity<Void> logout() {
-        SecurityContextHolder.clearContext();
-        return ResponseEntity.noContent().build();
-    }
-}
-```
-
-## Authentication Service
-
-```java
-@Service
-@RequiredArgsConstructor
-@Transactional
-public class AuthenticationService {
-    private final UserRepository userRepository;
-    private final PasswordEncoder passwordEncoder;
-    private final JwtService jwtService;
-    private final AuthenticationManager authenticationManager;
-
-    public AuthenticationResponse register(RegisterRequest request) {
-        if (userRepository.existsByEmail(request.email())) {
-            throw new DuplicateResourceException("Email already registered");
-        }
-
-        User user = User.builder()
-            .email(request.email())
-            .password(passwordEncoder.encode(request.password()))
-            .username(request.username())
-            .active(true)
-            .roles(Set.of(Role.builder().name("USER").build()))
-            .build();
-
-        user = userRepository.save(user);
-
-        String accessToken = jwtService.generateToken(convertToUserDetails(user));
-        String refreshToken = jwtService.generateRefreshToken(convertToUserDetails(user));
-
-        return new AuthenticationResponse(accessToken, refreshToken);
-    }
-
-    public AuthenticationResponse login(LoginRequest request) {
-        authenticationManager.authenticate(
-            new UsernamePasswordAuthenticationToken(
-                request.email(),
-                request.password()
-            )
-        );
-
-        User user = userRepository.findByEmail(request.email())
-            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
-
-        String accessToken = jwtService.generateToken(convertToUserDetails(user));
-        String refreshToken = jwtService.generateRefreshToken(convertToUserDetails(user));
-
-        return new AuthenticationResponse(accessToken, refreshToken);
-    }
-
-    public AuthenticationResponse refreshToken(RefreshTokenRequest request) {
-        String username = jwtService.extractUsername(request.refreshToken());
-
-        User user = userRepository.findByEmail(username)
-            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
-
-        UserDetails userDetails = convertToUserDetails(user);
-
-        if (!jwtService.isTokenValid(request.refreshToken(), userDetails)) {
-            throw new InvalidTokenException("Invalid refresh token");
-        }
-
-        String accessToken = jwtService.generateToken(userDetails);
-
-        return new AuthenticationResponse(accessToken, request.refreshToken());
-    }
-
-    private UserDetails convertToUserDetails(User user) {
-        return org.springframework.security.core.userdetails.User
-            .builder()
-            .username(user.getEmail())
-            .password(user.getPassword())
-            .authorities(user.getRoles().stream()
-                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
-                .collect(Collectors.toList()))
-            .build();
-    }
-}
-```
-
-## Method Security
-
-```java
-@Service
-@RequiredArgsConstructor
-public class UserService {
-    private final UserRepository userRepository;
-
-    @PreAuthorize("hasRole('ADMIN')")
-    public List<User> getAllUsers() {
-        return userRepository.findAll();
-    }
-
-    @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
-    public User getUserById(Long userId) {
-        return userRepository.findById(userId)
-            .orElseThrow(() -> new ResourceNotFoundException("User not found"));
-    }
-
-    @PreAuthorize("isAuthenticated()")
-    @PostAuthorize("returnObject.email == authentication.principal.username")
-    public User updateProfile(Long userId, UserUpdateRequest request) {
-        User user = getUserById(userId);
-        // Update logic
-        return userRepository.save(user);
-    }
-
-    @Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
-    public void deleteUser(Long userId) {
-        userRepository.deleteById(userId);
-    }
-}
-```
-
-## OAuth2 Resource Server (JWT)
-
-```java
-@Configuration
-@EnableWebSecurity
-public class OAuth2ResourceServerConfig {
-
-    @Bean
-    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-        http
-            .authorizeHttpRequests(auth -> auth
-                .requestMatchers("/public/**").permitAll()
-                .anyRequest().authenticated()
-            )
-            .oauth2ResourceServer(oauth2 -> oauth2
-                .jwt(jwt -> jwt
-                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
-                )
-            );
-
-        return http.build();
-    }
-
-    @Bean
-    public JwtDecoder jwtDecoder() {
-        return JwtDecoders.fromIssuerLocation("https://auth.example.com");
-    }
-
-    @Bean
-    public JwtAuthenticationConverter jwtAuthenticationConverter() {
-        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter =
-            new JwtGrantedAuthoritiesConverter();
-        grantedAuthoritiesConverter.setAuthoritiesClaimName("roles");
-        grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
-
-        JwtAuthenticationConverter jwtAuthenticationConverter =
-            new JwtAuthenticationConverter();
-        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(
-            grantedAuthoritiesConverter);
-
-        return jwtAuthenticationConverter;
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@EnableWebSecurity` | Enables Spring Security |
-| `@EnableMethodSecurity` | Enables method-level security annotations |
-| `@PreAuthorize` | Checks authorization before method execution |
-| `@PostAuthorize` | Checks authorization after method execution |
-| `@Secured` | Role-based method security |
-| `@WithMockUser` | Mock authenticated user in tests |
-| `@AuthenticationPrincipal` | Inject current user in controller |
-
-## Security Best Practices
-
-- Always use HTTPS in production
-- Store JWT secret in environment variables
-- Use strong password encoding (BCrypt with strength 12+)
-- Implement token refresh mechanism
-- Add rate limiting to authentication endpoints
-- Validate all user inputs
-- Log security events
-- Keep dependencies updated
-- Use CSRF protection for state-changing operations
-- Implement proper session timeout
diff --git a/.claude/skills/spring-boot-engineer/references/testing.md b/.claude/skills/spring-boot-engineer/references/testing.md
deleted file mode 100644
index 9bfec1d..0000000
--- a/.claude/skills/spring-boot-engineer/references/testing.md
+++ /dev/null
@@ -1,545 +0,0 @@
-# Testing - Spring Boot Test
-
-## Unit Testing with JUnit 5
-
-```java
-@ExtendWith(MockitoExtension.class)
-class UserServiceTest {
-
-    @Mock
-    private UserRepository userRepository;
-
-    @Mock
-    private PasswordEncoder passwordEncoder;
-
-    @InjectMocks
-    private UserService userService;
-
-    @Test
-    @DisplayName("Should create user successfully")
-    void shouldCreateUser() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        User user = User.builder()
-            .id(1L)
-            .email(request.email())
-            .username(request.username())
-            .build();
-
-        when(userRepository.existsByEmail(request.email())).thenReturn(false);
-        when(passwordEncoder.encode(request.password())).thenReturn("encodedPassword");
-        when(userRepository.save(any(User.class))).thenReturn(user);
-
-        // When
-        UserResponse response = userService.create(request);
-
-        // Then
-        assertThat(response).isNotNull();
-        assertThat(response.email()).isEqualTo(request.email());
-
-        verify(userRepository).existsByEmail(request.email());
-        verify(passwordEncoder).encode(request.password());
-        verify(userRepository).save(any(User.class));
-    }
-
-    @Test
-    @DisplayName("Should throw exception when email already exists")
-    void shouldThrowExceptionWhenEmailExists() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        when(userRepository.existsByEmail(request.email())).thenReturn(true);
-
-        // When & Then
-        assertThatThrownBy(() -> userService.create(request))
-            .isInstanceOf(DuplicateResourceException.class)
-            .hasMessageContaining("Email already registered");
-
-        verify(userRepository, never()).save(any(User.class));
-    }
-}
-```
-
-## Integration Testing with @SpringBootTest
-
-```java
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
-class UserIntegrationTest {
-
-    @Autowired
-    private TestRestTemplate restTemplate;
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @BeforeEach
-    void setUp() {
-        userRepository.deleteAll();
-    }
-
-    @Test
-    @Order(1)
-    @DisplayName("Should create user via API")
-    void shouldCreateUserViaApi() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        // When
-        ResponseEntity<UserResponse> response = restTemplate.postForEntity(
-            "/api/v1/users",
-            request,
-            UserResponse.class
-        );
-
-        // Then
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.CREATED);
-        assertThat(response.getBody()).isNotNull();
-        assertThat(response.getBody().email()).isEqualTo(request.email());
-        assertThat(response.getHeaders().getLocation()).isNotNull();
-    }
-
-    @Test
-    @Order(2)
-    @DisplayName("Should return validation error for invalid request")
-    void shouldReturnValidationError() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "invalid-email",
-            "short",
-            "u",
-            15
-        );
-
-        // When
-        ResponseEntity<ValidationErrorResponse> response = restTemplate.postForEntity(
-            "/api/v1/users",
-            request,
-            ValidationErrorResponse.class
-        );
-
-        // Then
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
-        assertThat(response.getBody()).isNotNull();
-        assertThat(response.getBody().errors()).isNotEmpty();
-    }
-}
-```
-
-## Web Layer Testing with MockMvc
-
-```java
-@WebMvcTest(UserController.class)
-@Import(SecurityConfig.class)
-class UserControllerTest {
-
-    @Autowired
-    private MockMvc mockMvc;
-
-    @MockBean
-    private UserService userService;
-
-    @Autowired
-    private ObjectMapper objectMapper;
-
-    @Test
-    @WithMockUser(roles = "ADMIN")
-    @DisplayName("Should get all users")
-    void shouldGetAllUsers() throws Exception {
-        // Given
-        Page<UserResponse> users = new PageImpl<>(List.of(
-            new UserResponse(1L, "user1@example.com", "user1", 25, true, null, null),
-            new UserResponse(2L, "user2@example.com", "user2", 30, true, null, null)
-        ));
-
-        when(userService.findAll(any(Pageable.class))).thenReturn(users);
-
-        // When & Then
-        mockMvc.perform(get("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.content").isArray())
-            .andExpect(jsonPath("$.content.length()").value(2))
-            .andExpect(jsonPath("$.content[0].email").value("user1@example.com"))
-            .andDo(print());
-    }
-
-    @Test
-    @WithMockUser(roles = "ADMIN")
-    @DisplayName("Should create user")
-    void shouldCreateUser() throws Exception {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        UserResponse response = new UserResponse(
-            1L,
-            request.email(),
-            request.username(),
-            request.age(),
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.create(any(UserCreateRequest.class))).thenReturn(response);
-
-        // When & Then
-        mockMvc.perform(post("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON)
-                .content(objectMapper.writeValueAsString(request)))
-            .andExpect(status().isCreated())
-            .andExpect(header().exists("Location"))
-            .andExpect(jsonPath("$.email").value(request.email()))
-            .andExpect(jsonPath("$.username").value(request.username()))
-            .andDo(print());
-    }
-
-    @Test
-    @WithMockUser(roles = "USER")
-    @DisplayName("Should return 403 for non-admin user")
-    void shouldReturn403ForNonAdmin() throws Exception {
-        mockMvc.perform(get("/api/v1/users")
-                .contentType(MediaType.APPLICATION_JSON))
-            .andExpect(status().isForbidden());
-    }
-}
-```
-
-## Data JPA Testing
-
-```java
-@DataJpaTest
-@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
-@ActiveProfiles("test")
-class UserRepositoryTest {
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @Autowired
-    private TestEntityManager entityManager;
-
-    @Test
-    @DisplayName("Should find user by email")
-    void shouldFindUserByEmail() {
-        // Given
-        User user = User.builder()
-            .email("test@example.com")
-            .password("password")
-            .username("testuser")
-            .active(true)
-            .build();
-
-        entityManager.persistAndFlush(user);
-
-        // When
-        Optional<User> found = userRepository.findByEmail("test@example.com");
-
-        // Then
-        assertThat(found).isPresent();
-        assertThat(found.get().getEmail()).isEqualTo("test@example.com");
-    }
-
-    @Test
-    @DisplayName("Should check if email exists")
-    void shouldCheckIfEmailExists() {
-        // Given
-        User user = User.builder()
-            .email("test@example.com")
-            .password("password")
-            .username("testuser")
-            .active(true)
-            .build();
-
-        entityManager.persistAndFlush(user);
-
-        // When
-        boolean exists = userRepository.existsByEmail("test@example.com");
-
-        // Then
-        assertThat(exists).isTrue();
-    }
-
-    @Test
-    @DisplayName("Should fetch user with roles")
-    void shouldFetchUserWithRoles() {
-        // Given
-        Role adminRole = Role.builder().name("ADMIN").build();
-        entityManager.persist(adminRole);
-
-        User user = User.builder()
-            .email("admin@example.com")
-            .password("password")
-            .username("admin")
-            .active(true)
-            .roles(Set.of(adminRole))
-            .build();
-
-        entityManager.persistAndFlush(user);
-        entityManager.clear();
-
-        // When
-        Optional<User> found = userRepository.findByEmailWithRoles("admin@example.com");
-
-        // Then
-        assertThat(found).isPresent();
-        assertThat(found.get().getRoles()).hasSize(1);
-        assertThat(found.get().getRoles()).extracting(Role::getName).contains("ADMIN");
-    }
-}
-```
-
-## Testcontainers for Database
-
-```java
-@SpringBootTest
-@Testcontainers
-@ActiveProfiles("test")
-class UserServiceIntegrationTest {
-
-    @Container
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:15-alpine")
-        .withDatabaseName("testdb")
-        .withUsername("test")
-        .withPassword("test");
-
-    @DynamicPropertySource
-    static void configureProperties(DynamicPropertyRegistry registry) {
-        registry.add("spring.datasource.url", postgres::getJdbcUrl);
-        registry.add("spring.datasource.username", postgres::getUsername);
-        registry.add("spring.datasource.password", postgres::getPassword);
-    }
-
-    @Autowired
-    private UserService userService;
-
-    @Autowired
-    private UserRepository userRepository;
-
-    @BeforeEach
-    void setUp() {
-        userRepository.deleteAll();
-    }
-
-    @Test
-    @DisplayName("Should create and find user in real database")
-    void shouldCreateAndFindUser() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        // When
-        UserResponse created = userService.create(request);
-        UserResponse found = userService.findById(created.id());
-
-        // Then
-        assertThat(found).isNotNull();
-        assertThat(found.email()).isEqualTo(request.email());
-    }
-}
-```
-
-## Testing Reactive Endpoints with WebTestClient
-
-```java
-@WebFluxTest(UserReactiveController.class)
-class UserReactiveControllerTest {
-
-    @Autowired
-    private WebTestClient webTestClient;
-
-    @MockBean
-    private UserReactiveService userService;
-
-    @Test
-    @DisplayName("Should get user reactively")
-    void shouldGetUserReactively() {
-        // Given
-        UserResponse user = new UserResponse(
-            1L,
-            "test@example.com",
-            "testuser",
-            25,
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.findById(1L)).thenReturn(Mono.just(user));
-
-        // When & Then
-        webTestClient.get()
-            .uri("/api/v1/users/{id}", 1L)
-            .accept(MediaType.APPLICATION_JSON)
-            .exchange()
-            .expectStatus().isOk()
-            .expectBody(UserResponse.class)
-            .value(response -> {
-                assertThat(response.id()).isEqualTo(1L);
-                assertThat(response.email()).isEqualTo("test@example.com");
-            });
-    }
-
-    @Test
-    @DisplayName("Should create user reactively")
-    void shouldCreateUserReactively() {
-        // Given
-        UserCreateRequest request = new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-
-        UserResponse response = new UserResponse(
-            1L,
-            request.email(),
-            request.username(),
-            request.age(),
-            true,
-            LocalDateTime.now(),
-            LocalDateTime.now()
-        );
-
-        when(userService.create(any(UserCreateRequest.class))).thenReturn(Mono.just(response));
-
-        // When & Then
-        webTestClient.post()
-            .uri("/api/v1/users")
-            .contentType(MediaType.APPLICATION_JSON)
-            .body(Mono.just(request), UserCreateRequest.class)
-            .exchange()
-            .expectStatus().isCreated()
-            .expectHeader().exists("Location")
-            .expectBody(UserResponse.class)
-            .value(user -> {
-                assertThat(user.email()).isEqualTo(request.email());
-            });
-    }
-}
-```
-
-## Testing Configuration
-
-```java
-// application-test.yml
-spring:
-  datasource:
-    url: jdbc:h2:mem:testdb
-    driver-class-name: org.h2.Driver
-  jpa:
-    hibernate:
-      ddl-auto: create-drop
-    show-sql: true
-    properties:
-      hibernate:
-        format_sql: true
-  security:
-    user:
-      name: test
-      password: test
-
-logging:
-  level:
-    org.hibernate.SQL: DEBUG
-    org.hibernate.type.descriptor.sql.BasicBinder: TRACE
-
-// Test Configuration Class
-@TestConfiguration
-public class TestConfig {
-
-    @Bean
-    @Primary
-    public PasswordEncoder passwordEncoder() {
-        return new BCryptPasswordEncoder(4); // Faster for tests
-    }
-
-    @Bean
-    public Clock fixedClock() {
-        return Clock.fixed(
-            Instant.parse("2024-01-01T00:00:00Z"),
-            ZoneId.of("UTC")
-        );
-    }
-}
-```
-
-## Test Fixtures with @DataJpaTest
-
-```java
-@Component
-public class TestDataFactory {
-
-    public static User createUser(String email, String username) {
-        return User.builder()
-            .email(email)
-            .password("encodedPassword")
-            .username(username)
-            .active(true)
-            .createdAt(LocalDateTime.now())
-            .updatedAt(LocalDateTime.now())
-            .build();
-    }
-
-    public static UserCreateRequest createUserRequest() {
-        return new UserCreateRequest(
-            "test@example.com",
-            "Password123",
-            "testuser",
-            25
-        );
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@SpringBootTest` | Full application context integration test |
-| `@WebMvcTest` | Test MVC controllers with mocked services |
-| `@WebFluxTest` | Test reactive controllers |
-| `@DataJpaTest` | Test JPA repositories with in-memory database |
-| `@MockBean` | Add mock bean to Spring context |
-| `@WithMockUser` | Mock authenticated user for security tests |
-| `@Testcontainers` | Enable Testcontainers support |
-| `@ActiveProfiles` | Activate specific Spring profiles for test |
-
-## Testing Best Practices
-
-- Write tests following AAA pattern (Arrange, Act, Assert)
-- Use descriptive test names with @DisplayName
-- Mock external dependencies, use real DB with Testcontainers
-- Achieve 85%+ code coverage
-- Test happy path and edge cases
-- Use @Transactional for test data cleanup
-- Separate unit tests from integration tests
-- Use parameterized tests for multiple scenarios
-- Test security rules and validation
-- Keep tests fast and independent
diff --git a/.claude/skills/spring-boot-engineer/references/web.md b/.claude/skills/spring-boot-engineer/references/web.md
deleted file mode 100644
index 2eabbbb..0000000
--- a/.claude/skills/spring-boot-engineer/references/web.md
+++ /dev/null
@@ -1,295 +0,0 @@
-# Web Layer - Controllers & REST APIs
-
-## REST Controller Pattern
-
-```java
-@RestController
-@RequestMapping("/api/v1/users")
-@Validated
-@RequiredArgsConstructor
-public class UserController {
-    private final UserService userService;
-
-    @GetMapping
-    public ResponseEntity<Page<UserResponse>> getUsers(
-            @PageableDefault(size = 20, sort = "createdAt") Pageable pageable) {
-        Page<UserResponse> users = userService.findAll(pageable);
-        return ResponseEntity.ok(users);
-    }
-
-    @GetMapping("/{id}")
-    public ResponseEntity<UserResponse> getUser(@PathVariable Long id) {
-        UserResponse user = userService.findById(id);
-        return ResponseEntity.ok(user);
-    }
-
-    @PostMapping
-    public ResponseEntity<UserResponse> createUser(
-            @Valid @RequestBody UserCreateRequest request) {
-        UserResponse user = userService.create(request);
-        URI location = ServletUriComponentsBuilder
-                .fromCurrentRequest()
-                .path("/{id}")
-                .buildAndExpand(user.id())
-                .toUri();
-        return ResponseEntity.created(location).body(user);
-    }
-
-    @PutMapping("/{id}")
-    public ResponseEntity<UserResponse> updateUser(
-            @PathVariable Long id,
-            @Valid @RequestBody UserUpdateRequest request) {
-        UserResponse user = userService.update(id, request);
-        return ResponseEntity.ok(user);
-    }
-
-    @DeleteMapping("/{id}")
-    @ResponseStatus(HttpStatus.NO_CONTENT)
-    public void deleteUser(@PathVariable Long id) {
-        userService.delete(id);
-    }
-}
-```
-
-## Request DTOs with Validation
-
-```java
-public record UserCreateRequest(
-    @NotBlank(message = "Email is required")
-    @Email(message = "Email must be valid")
-    String email,
-
-    @NotBlank(message = "Password is required")
-    @Size(min = 8, max = 100, message = "Password must be 8-100 characters")
-    @Pattern(regexp = "^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).*$",
-             message = "Password must contain uppercase, lowercase, and digit")
-    String password,
-
-    @NotBlank(message = "Username is required")
-    @Size(min = 3, max = 50)
-    @Pattern(regexp = "^[a-zA-Z0-9_]+$", message = "Username must be alphanumeric")
-    String username,
-
-    @Min(value = 18, message = "Must be at least 18")
-    @Max(value = 120, message = "Must be at most 120")
-    Integer age
-) {}
-
-public record UserUpdateRequest(
-    @Email(message = "Email must be valid")
-    String email,
-
-    @Size(min = 3, max = 50)
-    String username
-) {}
-```
-
-## Response DTOs
-
-```java
-public record UserResponse(
-    Long id,
-    String email,
-    String username,
-    Integer age,
-    Boolean active,
-    LocalDateTime createdAt,
-    LocalDateTime updatedAt
-) {
-    public static UserResponse from(User user) {
-        return new UserResponse(
-            user.getId(),
-            user.getEmail(),
-            user.getUsername(),
-            user.getAge(),
-            user.getActive(),
-            user.getCreatedAt(),
-            user.getUpdatedAt()
-        );
-    }
-}
-```
-
-## Global Exception Handling
-
-```java
-@RestControllerAdvice
-@Slf4j
-public class GlobalExceptionHandler {
-
-    @ExceptionHandler(ResourceNotFoundException.class)
-    public ResponseEntity<ErrorResponse> handleNotFound(
-            ResourceNotFoundException ex, WebRequest request) {
-        log.error("Resource not found: {}", ex.getMessage());
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.NOT_FOUND.value(),
-            ex.getMessage(),
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.NOT_FOUND);
-    }
-
-    @ExceptionHandler(MethodArgumentNotValidException.class)
-    public ResponseEntity<ValidationErrorResponse> handleValidation(
-            MethodArgumentNotValidException ex) {
-        Map<String, String> errors = ex.getBindingResult()
-            .getFieldErrors()
-            .stream()
-            .collect(Collectors.toMap(
-                FieldError::getField,
-                error -> error.getDefaultMessage() != null
-                    ? error.getDefaultMessage()
-                    : "Invalid value"
-            ));
-
-        ValidationErrorResponse response = new ValidationErrorResponse(
-            HttpStatus.BAD_REQUEST.value(),
-            "Validation failed",
-            errors,
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(response, HttpStatus.BAD_REQUEST);
-    }
-
-    @ExceptionHandler(DataIntegrityViolationException.class)
-    public ResponseEntity<ErrorResponse> handleDataIntegrity(
-            DataIntegrityViolationException ex, WebRequest request) {
-        log.error("Data integrity violation", ex);
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.CONFLICT.value(),
-            "Data integrity violation - resource may already exist",
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.CONFLICT);
-    }
-
-    @ExceptionHandler(Exception.class)
-    public ResponseEntity<ErrorResponse> handleGlobalException(
-            Exception ex, WebRequest request) {
-        log.error("Unexpected error", ex);
-        ErrorResponse error = new ErrorResponse(
-            HttpStatus.INTERNAL_SERVER_ERROR.value(),
-            "An unexpected error occurred",
-            request.getDescription(false),
-            LocalDateTime.now()
-        );
-        return new ResponseEntity<>(error, HttpStatus.INTERNAL_SERVER_ERROR);
-    }
-}
-
-record ErrorResponse(
-    int status,
-    String message,
-    String path,
-    LocalDateTime timestamp
-) {}
-
-record ValidationErrorResponse(
-    int status,
-    String message,
-    Map<String, String> errors,
-    LocalDateTime timestamp
-) {}
-```
-
-## Custom Validation
-
-```java
-@Target({ElementType.FIELD, ElementType.PARAMETER})
-@Retention(RetentionPolicy.RUNTIME)
-@Constraint(validatedBy = UniqueEmailValidator.class)
-public @interface UniqueEmail {
-    String message() default "Email already exists";
-    Class<?>[] groups() default {};
-    Class<? extends Payload>[] payload() default {};
-}
-
-@Component
-@RequiredArgsConstructor
-public class UniqueEmailValidator implements ConstraintValidator<UniqueEmail, String> {
-    private final UserRepository userRepository;
-
-    @Override
-    public boolean isValid(String email, ConstraintValidatorContext context) {
-        if (email == null) return true;
-        return !userRepository.existsByEmail(email);
-    }
-}
-```
-
-## WebClient for External APIs
-
-```java
-@Configuration
-public class WebClientConfig {
-    @Bean
-    public WebClient webClient(WebClient.Builder builder) {
-        return builder
-            .baseUrl("https://api.example.com")
-            .defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
-            .filter(logRequest())
-            .build();
-    }
-
-    private ExchangeFilterFunction logRequest() {
-        return ExchangeFilterFunction.ofRequestProcessor(request -> {
-            log.info("Request: {} {}", request.method(), request.url());
-            return Mono.just(request);
-        });
-    }
-}
-
-@Service
-@RequiredArgsConstructor
-public class ExternalApiService {
-    private final WebClient webClient;
-
-    public Mono<ExternalDataResponse> fetchData(String id) {
-        return webClient
-            .get()
-            .uri("/data/{id}", id)
-            .retrieve()
-            .onStatus(HttpStatusCode::is4xxClientError, response ->
-                Mono.error(new ResourceNotFoundException("External resource not found")))
-            .onStatus(HttpStatusCode::is5xxServerError, response ->
-                Mono.error(new ServiceUnavailableException("External service unavailable")))
-            .bodyToMono(ExternalDataResponse.class)
-            .timeout(Duration.ofSeconds(5))
-            .retry(3);
-    }
-}
-```
-
-## CORS Configuration
-
-```java
-@Configuration
-public class WebConfig implements WebMvcConfigurer {
-
-    @Override
-    public void addCorsMappings(CorsRegistry registry) {
-        registry.addMapping("/api/**")
-            .allowedOrigins("http://localhost:3000", "https://example.com")
-            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
-            .allowedHeaders("*")
-            .allowCredentials(true)
-            .maxAge(3600);
-    }
-}
-```
-
-## Quick Reference
-
-| Annotation | Purpose |
-|------------|---------|
-| `@RestController` | Marks class as REST controller (combines @Controller + @ResponseBody) |
-| `@RequestMapping` | Maps HTTP requests to handler methods |
-| `@GetMapping/@PostMapping` | HTTP method-specific mappings |
-| `@PathVariable` | Extracts values from URI path |
-| `@RequestParam` | Extracts query parameters |
-| `@RequestBody` | Binds request body to method parameter |
-| `@Valid` | Triggers validation on request body |
-| `@RestControllerAdvice` | Global exception handling for REST controllers |
-| `@ResponseStatus` | Sets HTTP status code for method |
diff --git a/.env.example b/.env.example
index f752fdf..3f1c5ee 100644
--- a/.env.example
+++ b/.env.example
@@ -20,3 +20,16 @@ HUGGINGFACE_API_KEY=your_huggingface_api_key_here
 WHATSAPP_API_TOKEN=your_whatsapp_api_token_here
 WHATSAPP_PHONE_NUMBER_ID=your_phone_number_id_here
 WHATSAPP_VERIFY_TOKEN=your_webhook_verify_token_here
+
+# Consumer Cache Backend
+# MEMORY, REDIS, or HYBRID
+CONSUMER_CACHE_BACKEND=MEMORY
+CONSUMER_CACHE_KEY_PREFIX=varutri:consumer
+
+# Redis Configuration (required when CONSUMER_CACHE_BACKEND=REDIS or HYBRID)
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_USERNAME=
+REDIS_PASSWORD=
+REDIS_DATABASE=0
+REDIS_SSL_ENABLED=false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c5c9722
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,50 @@
+name: Build and Quality Checks
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  backend-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Compile backend
+        run: mvn -B -DskipTests compile
+
+  quality-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Frontend and extension syntax checks
+        run: |
+          node --check frontend/app.js
+          node --check consumer_extension/background.js
+          node --check consumer_extension/content.js
+          node --check consumer_extension/popup.js
+
+      - name: Shell script syntax checks
+        run: |
+          bash -n test-api.sh
+          bash -n test-scam-simulation.sh
+
+      - name: Docker Compose configuration check
+        run: docker compose config >/dev/null
diff --git a/.gitignore b/.gitignore
index 41fc445..3ea45aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,6 +31,11 @@ build/
 ### VS Code ###
 .vscode/
 
+### Tooling metadata ###
+.agent/
+.claude/
+.kiro/
+
 ### Mac ###
 .DS_Store
 
diff --git a/.kiro/specs/varutri-command-center/.config.kiro b/.kiro/specs/varutri-command-center/.config.kiro
deleted file mode 100644
index d30049b..0000000
--- a/.kiro/specs/varutri-command-center/.config.kiro
+++ /dev/null
@@ -1 +0,0 @@
-{"generationMode": "requirements-first"}
\ No newline at end of file
diff --git a/.kiro/specs/varutri-command-center/design.md b/.kiro/specs/varutri-command-center/design.md
deleted file mode 100644
index c00d3c7..0000000
--- a/.kiro/specs/varutri-command-center/design.md
+++ /dev/null
@@ -1,828 +0,0 @@
-# Design Document: Varutri Command Center
-
-## 1. System Architecture
-
-### 1.1 Technology Stack
-
-- **Backend Framework**: Spring Boot 17 (Java)
-- **Database**: MongoDB (for evidence and session storage)
-- **LLM Providers**: 
-  - HuggingFace API (Llama 3.3 70B)
-  - Ollama (local deployment option)
-- **External Integrations**: WhatsApp Business API, Government Reporting APIs
-
-### 1.2 Architectural Layers
-
-The system follows a layered architecture pattern:
-
-1. **Presentation Layer**: REST Controllers exposing API endpoints
-2. **Service Layer**: Business logic and orchestration
-3. **Data Layer**: MongoDB repositories and data access
-4. **Integration Layer**: External service clients (LLM, WhatsApp, Government APIs)
-
-### 1.3 Core Components
-
-#### 1.3.1 Controller Layer
-- **HoneypotController**: Main chat API and threat assessment endpoints
-- **PersonaController**: Persona management and configuration
-- **WhatsAppController**: WhatsApp webhook integration
-- **ReportController**: Government reporting endpoints
-
-#### 1.3.2 Service Layer
-
-**AI Services**:
-- **EnsembleThreatScorer**: Multi-layer threat detection pipeline
-- **InformationExtractor**: Intelligence extraction from messages
-- **ScamDetector**: Scam type classification
-- **TextNormalizer**: Text normalization and obfuscation detection
-- **AdvancedPatternMatcher**: Fuzzy matching and phonetic analysis
-- **SemanticScamAnalyzer**: Semantic analysis and intent detection
-- **PromptHardeningService**: LLM prompt security
-- **ResponseValidationService**: AI response validation
-
-**LLM Services**:
-- **PersonaService**: Persona profile management
-- **HuggingFaceService**: HuggingFace API integration
-- **OllamaService**: Ollama local LLM integration
-
-**Core Services**:
-- **GovernmentReportService**: Report generation and submission
-- **CallbackService**: External callback handling
-- **WhatsAppService**: WhatsApp message sending
-
-**Data Services**:
-- **SessionStore**: Conversation session management
-- **EvidenceCollector**: Evidence aggregation and storage
-
-**Security Services**:
-- **InputSanitizer**: Input validation and sanitization
-- **RateLimitService**: API rate limiting
-
-#### 1.3.3 Data Layer
-- **SessionRepository**: Session entity persistence
-- **EvidenceRepository**: Evidence entity persistence
-- **ScamReportRepository**: Report entity persistence
-
-## 2. Component Design
-
-### 2.1 Multi-Layer Threat Detection Pipeline
-
-The threat detection system uses a five-layer ensemble approach:
-
-**Layer 1: Text Normalization**
-- Detects and converts leetspeak (h3ll0 → hello)
-- Normalizes homoglyphs (Cyrillic 'а' → Latin 'a')
-- Removes zero-width and invisible characters
-- Normalizes whitespace and formatting
-- Preserves original text for evidence
-
-**Layer 2: Regex-Based Keyword Matching**
-- Pattern matching for known scam indicators
-- UPI ID detection: [digits]@[provider]
-- Bank account and IFSC code detection
-- Phone number extraction (Indian format)
-- URL and email extraction
-- Suspicious keyword identification
-
-**Layer 3: Advanced Pattern Matching**
-- Fuzzy string matching for near-matches
-- Phonetic analysis for sound-alike variations
-- N-gram analysis for partial matches
-- Configurable similarity thresholds
-- Levenshtein distance calculations
-
-**Layer 4: Semantic ML Analysis**
-- Semantic embeddings for contextual understanding
-- Intent classification for manipulation tactics
-- Urgency indicator detection
-- Trust exploitation pattern recognition
-- Financial solicitation detection
-
-**Layer 5: AI Phishing Model**
-- Sophisticated phishing attempt detection
-- Context-aware threat assessment
-- Advanced manipulation tactic identification
-
-**Ensemble Scoring**:
-- Weighted scoring based on layer reliability
-- Confidence calibration to reduce false positives
-- Conflict resolution when layers disagree
-- Final threat level: 0.0-1.0 normalized score
-- Confidence intervals for assessments
-- Layer-specific contribution tracking
-
-### 2.2 AI Persona Management
-
-**Persona Profile Structure**:
-- Name, age, occupation
-- City, country, living status
-- Tech-savviness level
-- Personality traits
-- Language style characteristics
-- Example phrases
-- Common typing mistakes
-
-**Persona Engine**:
-- Maintains configurable persona profiles
-- Generates contextually appropriate responses
-- Incorporates persona characteristics consistently
-- Supports multiple LLM backends
-- Dynamic configuration without restart
-
-**Preset Personas**:
-- Elderly Indian male (default: Rajesh Kumar)
-- Elderly Indian female (Kamala Devi)
-- Young American student (Mike Johnson)
-- Elderly British (Margaret Thompson)
-
-### 2.3 Intelligence Extraction
-
-**Extraction Capabilities**:
-- **Payment Information**: UPI IDs in format [digits]@[provider]
-- **Banking Information**: Account numbers, IFSC codes
-- **Contact Information**: Phone numbers (Indian format)
-- **Web References**: URLs, email addresses
-- **Scam Indicators**: Suspicious keywords, pattern indicators
-
-**Intelligence Association**:
-- All extracted intelligence linked to originating session
-- Traceability for investigation purposes
-- Real-time extraction during conversation
-
-### 2.4 Evidence Collection and Storage
-
-**Evidence Package Structure**:
-- Session identifier
-- Complete conversation history with timestamps
-- Sender identification for each message
-- Threat level scores per message
-- Scam type classification
-- Ensemble scoring results
-- Confidence calibration data
-- Extracted intelligence summary
-
-**Storage Requirements**:
-- Persistent MongoDB storage
-- Data integrity enforcement
-- Tamper prevention mechanisms
-- Query by session identifier
-- Filter by threat level threshold
-- High-threat evidence retrieval
-
-### 2.5 Session Management
-
-**Session Lifecycle**:
-- Unique session per conversation thread
-- Turn counting and limits (default: 20 turns)
-- Conversation history tracking
-- Intelligence status updates
-- Session clearing after callback
-
-**Session Triggers**:
-- Max turns reached
-- High threat detected
-- Critical evidence collected
-- Manual callback request
-
-### 2.6 LLM Integration
-
-**Provider Support**:
-- HuggingFace API (cloud-based)
-- Ollama (local deployment)
-- Configurable provider selection
-- Fallback handling
-
-**Asynchronous Processing**:
-- Non-blocking response generation
-- CompletableFuture-based async pipeline
-- Parallel task execution
-- Graceful degradation on failures
-
-**Prompt Engineering**:
-- System prompt generation with persona context
-- Threat-aware prompt adaptation
-- Prompt injection detection and prevention
-- Response validation and filtering
-
-### 2.7 Security Architecture
-
-**Authentication**:
-- API key-based authentication
-- Endpoint-level security (except health checks)
-- HTTP 401 on invalid authentication
-
-**Input Validation**:
-- Input sanitization for all user input
-- Prompt injection detection
-- SQL/NoSQL injection prevention
-- XSS prevention
-
-**Rate Limiting**:
-- Request rate limiting per API key
-- Abuse prevention
-- DoS attack mitigation
-- Request queuing on limit exceeded
-
-**Session Security**:
-- Secure session management
-- Appropriate timeout policies
-- Authentication failure logging
-
-### 2.8 WhatsApp Integration
-
-**Webhook Handling**:
-- Meta webhook verification
-- Message receipt confirmation
-- Event processing
-
-**Message Processing**:
-- Text message extraction
-- Button interaction handling
-- Scam report detection
-- Phone-to-session mapping
-
-**User Notifications**:
-- Takeover notifications
-- Intelligence extraction alerts
-- Confirmation messages
-- Button-based interactions
-
-**Session Tracking**:
-- Separate session per WhatsApp conversation
-- Phone number to session ID mapping
-- Session status retrieval
-
-### 2.9 Government Reporting
-
-**Report Generation**:
-- Automatic report creation on session completion
-- Manual report triggering
-- Evidence package aggregation
-- Threat level assessment
-
-**Report Structure**:
-- Unique report identifier
-- Session reference
-- Extracted intelligence (UPI IDs, bank accounts, phone numbers, URLs)
-- Threat level and scam type
-- Conversation summary
-- Timestamp and metadata
-
-**Report Submission**:
-- External API integration
-- Callback mechanism support
-- Confirmation tracking
-- Report archival
-
-**Report Retrieval**:
-- Query by report ID
-- List all archived reports
-- Statistical aggregation
-
-## 3. API Design
-
-### 3.1 Chat API
-
-**POST /api/chat**
-- Asynchronous message processing
-- Parallel intelligence extraction and threat assessment
-- Persona-based response generation
-- Evidence collection
-- Automatic callback triggering
-
-**Response Format**:
-```
-{
-  "status": "success",
-  "reply": "<persona_response>"
-}
-```
-
-### 3.2 Threat Assessment API
-
-**POST /api/assess**
-- Synchronous threat assessment
-- Comprehensive ensemble analysis
-- Detailed layer-by-layer results
-- Confidence calibration
-
-**Response Format**:
-```
-{
-  "status": "success",
-  "data": {
-    "threatLevel": "HIGH|MEDIUM|LOW",
-    "ensembleScore": 0.0-1.0,
-    "confidencePercent": 0-100,
-    "scamType": "INVESTMENT|LOTTERY|...",
-    "triggeredLayers": 0-5,
-    "layerResults": [...]
-  }
-}
-```
-
-### 3.3 Evidence API
-
-**GET /api/evidence/{sessionId}**
-- Retrieve session-specific evidence
-- Complete evidence package
-
-**GET /api/evidence/high-threat**
-- Retrieve high-risk evidence (threat >= 0.7)
-- Filtered evidence list
-
-**GET /api/evidence**
-- Retrieve all evidence packages
-- Complete evidence archive
-
-### 3.4 Persona API
-
-**GET /api/persona**
-- Current persona details
-
-**PUT /api/persona**
-- Update persona profile
-
-**POST /api/persona/reset**
-- Reset to default persona
-
-**GET /api/persona/presets**
-- List available preset personas
-
-**POST /api/persona/presets/{presetName}**
-- Apply preset persona
-
-### 3.5 WhatsApp API
-
-**GET /api/whatsapp/webhook**
-- Webhook verification (Meta requirement)
-
-**POST /api/whatsapp/webhook**
-- Receive WhatsApp messages
-- Process and respond
-
-**POST /api/whatsapp/takeover**
-- Manual takeover initiation
-
-**GET /api/whatsapp/session/{phone}**
-- Session status retrieval
-
-### 3.6 Reporting API
-
-**POST /api/report/manual**
-- Manual report generation and submission
-
-**GET /api/report/{reportId}**
-- Retrieve specific report
-
-**GET /api/report/all**
-- List all archived reports
-
-**GET /api/report/stats**
-- Report statistics and aggregation
-
-### 3.7 Health API
-
-**GET /api/health**
-- System health status
-- Database connectivity check
-- LLM service availability check
-- No authentication required
-
-## 4. Data Models
-
-### 4.1 Core Entities
-
-**SessionEntity**:
-- Session ID (unique identifier)
-- Conversation messages (list)
-- Turn count
-- Intelligence status
-- Creation and update timestamps
-
-**EvidenceEntity**:
-- Session ID reference
-- Extracted intelligence
-- Threat level
-- Scam type
-- Conversation history
-- Ensemble scoring data
-- Timestamps
-
-**ScamReportEntity**:
-- Report ID (unique identifier)
-- Session ID reference
-- Extracted intelligence lists
-- Threat level
-- Scam type
-- Report status
-- Submission timestamp
-
-### 4.2 DTOs
-
-**ChatRequest**:
-- Session ID
-- Message (sender, text, timestamp)
-- Conversation history
-- Metadata
-
-**ChatResponse**:
-- Reply text
-- (Internal: session ID, threat level, scam type)
-
-**ThreatAssessmentResponse**:
-- Threat level category
-- Ensemble score
-- Confidence percentage
-- Scam type
-- Triggered layers count
-- Layer-specific results
-
-**ExtractedInfo**:
-- UPI IDs
-- Bank account numbers
-- IFSC codes
-- Phone numbers
-- URLs
-- Email addresses
-- Suspicious keywords
-
-**PersonaProfile**:
-- Name, age, occupation
-- City, country, living status
-- Tech level
-- Personality traits
-- Language style
-- Example phrases
-- Common mistakes
-
-## 5. Configuration Management
-
-### 5.1 Configuration Sources
-- Environment variables
-- Application properties files
-- External configuration files
-
-### 5.2 Configurable Parameters
-
-**LLM Configuration**:
-- Provider selection (huggingface/ollama)
-- API keys and endpoints
-- Model selection
-- Timeout settings
-
-**Security Configuration**:
-- API keys
-- Rate limiting thresholds
-- Session timeout policies
-
-**Threat Detection Configuration**:
-- Sensitivity levels
-- Layer weights
-- Confidence thresholds
-
-**Database Configuration**:
-- MongoDB connection parameters
-- Connection pooling settings
-
-**Session Configuration**:
-- Max turns per session
-- Callback triggers
-
-**WhatsApp Configuration**:
-- Webhook verification token
-- API credentials
-
-### 5.3 Startup Validation
-- Configuration validation on startup
-- Clear error messages on invalid configuration
-- Fail-fast behavior
-
-## 6. Performance and Scalability
-
-### 6.1 Asynchronous Processing
-- CompletableFuture-based async pipeline
-- Non-blocking chat endpoint
-- Parallel intelligence extraction and threat assessment
-- Background callback processing
-
-### 6.2 Concurrent Processing
-- Multiple session support
-- Thread-safe session management
-- Concurrent evidence collection
-
-### 6.3 Database Optimization
-- Connection pooling
-- Indexed queries
-- Efficient data retrieval
-
-### 6.4 Horizontal Scaling
-- Stateless API design
-- Session data in MongoDB (shared state)
-- Load balancer compatible
-
-### 6.5 Degraded Mode Support
-- Graceful handling of database failures
-- LLM service fallback
-- Continued operation with reduced functionality
-
-## 7. Error Handling
-
-### 7.1 Exception Hierarchy
-- **ResourceNotFoundException**: 404 responses
-- **RateLimitExceededException**: 429 responses
-- **LLMServiceException**: 503 responses
-- **GlobalExceptionHandler**: Centralized error handling
-
-### 7.2 Error Response Format
-```
-{
-  "status": "error",
-  "message": "<error_description>",
-  "errorCode": "<ERROR_CODE>"
-}
-```
-
-### 7.3 Logging Strategy
-- Structured logging with SLF4J
-- Log levels: INFO, WARN, ERROR
-- Security event logging
-- Performance metrics logging
-
-## 8. Testing Strategy
-
-### 8.1 Unit Testing
-- Service layer unit tests
-- Mock external dependencies
-- Test individual components
-
-### 8.2 Integration Testing
-- Controller integration tests
-- Database integration tests
-- LLM service integration tests
-
-### 8.3 Property-Based Testing
-- Threat detection property tests
-- Intelligence extraction property tests
-- Input validation property tests
-
-### 8.4 Simulation Testing
-- ScamSimulator for scenario testing
-- End-to-end conversation simulation
-- Intelligence extraction validation
-
-## 9. Deployment Considerations
-
-### 9.1 Environment Requirements
-- Java 17 runtime
-- MongoDB instance
-- Network access to LLM providers
-- WhatsApp Business API access
-
-### 9.2 Configuration Management
-- Environment-specific configuration
-- Secrets management
-- Configuration validation
-
-### 9.3 Monitoring and Observability
-- Health check endpoint
-- Application metrics
-- Log aggregation
-- Alert configuration
-
-### 9.4 Scaling Strategy
-- Horizontal scaling with load balancer
-- MongoDB replica set for high availability
-- Rate limiting per instance
-
-## 10. Security Considerations
-
-### 10.1 Data Protection
-- Sensitive data encryption at rest
-- Secure transmission (HTTPS)
-- PII handling compliance
-
-### 10.2 Access Control
-- API key authentication
-- Role-based access (future enhancement)
-- Audit logging
-
-### 10.3 Input Validation
-- Comprehensive input sanitization
-- Injection attack prevention
-- Prompt injection detection
-
-### 10.4 Rate Limiting
-- Per-API-key rate limits
-- Global rate limits
-- DDoS protection
-
-## 11. Future Enhancements
-
-### 11.1 Advanced Analytics
-- Scam trend analysis
-- Intelligence correlation
-- Predictive threat modeling
-
-### 11.2 Multi-Channel Support
-- Telegram integration
-- Email integration
-- SMS integration
-
-### 11.3 Enhanced Reporting
-- Automated report scheduling
-- Multi-agency reporting
-- Report templates
-
-### 11.4 Machine Learning Improvements
-- Custom ML model training
-- Adaptive threat detection
-- Persona learning from interactions
-
-## 12. Correctness Properties
-
-### 12.1 Threat Detection Properties
-
-**Property 1.1: Normalization Idempotence**
-- **Validates**: Requirements 2.2, 14.1-14.4
-- **Property**: Normalizing text twice produces the same result as normalizing once
-- **Formal**: ∀ text: normalize(normalize(text)) = normalize(text)
-
-**Property 1.2: Threat Score Bounds**
-- **Validates**: Requirements 2.8, 13.5
-- **Property**: All threat scores are within valid range [0.0, 1.0]
-- **Formal**: ∀ message: 0.0 ≤ assessThreat(message).ensembleScore ≤ 1.0
-
-**Property 1.3: Layer Monotonicity**
-- **Validates**: Requirements 2.1, 13.1
-- **Property**: Adding more triggered layers never decreases threat score
-- **Formal**: ∀ message: triggeredLayers(message) ≥ n ⇒ threatScore(message) ≥ baseline
-
-**Property 1.4: High Threat Consistency**
-- **Validates**: Requirements 2.7, 13.5
-- **Property**: Messages classified as HIGH threat have ensemble score ≥ 0.7
-- **Formal**: ∀ message: threatLevel(message) = "HIGH" ⇒ ensembleScore(message) ≥ 0.7
-
-### 12.2 Intelligence Extraction Properties
-
-**Property 2.1: UPI ID Format Validity**
-- **Validates**: Requirements 3.1
-- **Property**: All extracted UPI IDs match the format [digits]@[provider]
-- **Formal**: ∀ upiId ∈ extractedUPIs(message): upiId matches /\d+@[\w]+/
-
-**Property 2.2: Extraction Completeness**
-- **Validates**: Requirements 3.1-3.5
-- **Property**: All valid intelligence patterns in message are extracted
-- **Formal**: ∀ pattern ∈ message: isValid(pattern) ⇒ pattern ∈ extractedInfo(message)
-
-**Property 2.3: No False Extractions**
-- **Validates**: Requirements 3.1-3.5
-- **Property**: Extracted intelligence items are actually present in the message
-- **Formal**: ∀ item ∈ extractedInfo(message): item ⊆ message
-
-### 12.3 Session Management Properties
-
-**Property 3.1: Session Uniqueness**
-- **Validates**: Requirements 4.1, 4.5
-- **Property**: Each session ID is unique across all sessions
-- **Formal**: ∀ session1, session2: session1 ≠ session2 ⇒ session1.id ≠ session2.id
-
-**Property 3.2: Message Ordering**
-- **Validates**: Requirements 4.1
-- **Property**: Messages in a session are ordered by timestamp
-- **Formal**: ∀ i, j in session.messages: i < j ⇒ timestamp(i) ≤ timestamp(j)
-
-**Property 3.3: Turn Count Accuracy**
-- **Validates**: Requirements 9.2
-- **Property**: Turn count equals the number of user-assistant message pairs
-- **Formal**: ∀ session: turnCount(session) = count(userMessages(session))
-
-### 12.4 Evidence Storage Properties
-
-**Property 4.1: Evidence Persistence**
-- **Validates**: Requirements 4.1, 4.7
-- **Property**: Stored evidence can be retrieved without modification
-- **Formal**: ∀ evidence: retrieve(store(evidence)) = evidence
-
-**Property 4.2: Session-Evidence Association**
-- **Validates**: Requirements 3.6, 4.5
-- **Property**: Evidence is correctly associated with its originating session
-- **Formal**: ∀ evidence: evidence.sessionId ∈ activeSessions
-
-**Property 4.3: High Threat Filtering**
-- **Validates**: Requirements 4.6
-- **Property**: High threat query returns only evidence with threat ≥ 0.7
-- **Formal**: ∀ evidence ∈ getHighThreatEvidence(): evidence.threatLevel ≥ 0.7
-
-### 12.5 API Security Properties
-
-**Property 5.1: Authentication Enforcement**
-- **Validates**: Requirements 8.1, 8.2
-- **Property**: Protected endpoints reject requests without valid API key
-- **Formal**: ∀ request to protectedEndpoint: !hasValidApiKey(request) ⇒ response.status = 401
-
-**Property 5.2: Rate Limit Compliance**
-- **Validates**: Requirements 8.3, 9.6
-- **Property**: Requests exceeding rate limit are queued or rejected
-- **Formal**: ∀ apiKey: requestCount(apiKey, timeWindow) > limit ⇒ request queued or rejected
-
-**Property 5.3: Input Sanitization**
-- **Validates**: Requirements 8.4, 8.5
-- **Property**: All user input is sanitized before processing
-- **Formal**: ∀ input: process(input) = process(sanitize(input))
-
-### 12.6 Persona Consistency Properties
-
-**Property 6.1: Persona Attribute Preservation**
-- **Validates**: Requirements 1.1, 1.4
-- **Property**: Persona characteristics remain consistent across responses
-- **Formal**: ∀ response in session: extractPersonaTraits(response) ⊆ currentPersona.traits
-
-**Property 6.2: Dynamic Configuration**
-- **Validates**: Requirements 1.5
-- **Property**: Persona updates take effect immediately without restart
-- **Formal**: ∀ update: updatePersona(newPersona) ⇒ nextResponse uses newPersona
-
-### 12.7 Scam Classification Properties
-
-**Property 7.1: Classification Completeness**
-- **Validates**: Requirements 10.1-10.6
-- **Property**: Every detected threat is assigned a scam type
-- **Formal**: ∀ message: threatLevel(message) > 0.5 ⇒ scamType(message) ∈ validScamTypes
-
-**Property 7.2: Most Specific Classification**
-- **Validates**: Requirements 10.7
-- **Property**: Multi-category scams are assigned the most specific type
-- **Formal**: ∀ message: matches(message, [type1, type2]) ⇒ scamType(message) = mostSpecific([type1, type2])
-
-### 12.8 Asynchronous Processing Properties
-
-**Property 8.1: Non-Blocking Chat**
-- **Validates**: Requirements 9.1
-- **Property**: Chat endpoint returns CompletableFuture immediately
-- **Formal**: ∀ request: responseTime(chat(request)) < blockingThreshold
-
-**Property 8.2: Parallel Task Completion**
-- **Validates**: Requirements 9.2
-- **Property**: Intelligence extraction and threat assessment complete independently
-- **Formal**: ∀ message: extractionFuture(message) ∥ assessmentFuture(message)
-
-### 12.9 WhatsApp Integration Properties
-
-**Property 9.1: Webhook Verification**
-- **Validates**: Requirements 6.1
-- **Property**: Webhook verification succeeds only with correct token
-- **Formal**: ∀ request: verifyWebhook(request) = true ⇔ request.token = configuredToken
-
-**Property 9.2: Session Isolation**
-- **Validates**: Requirements 6.4
-- **Property**: Each WhatsApp phone number has a unique session
-- **Formal**: ∀ phone1, phone2: phone1 ≠ phone2 ⇒ session(phone1) ≠ session(phone2)
-
-### 12.10 Reporting Properties
-
-**Property 10.1: Report Completeness**
-- **Validates**: Requirements 7.2, 7.3
-- **Property**: Reports contain all extracted intelligence from the session
-- **Formal**: ∀ session: extractedInfo(report(session)) = extractedInfo(evidence(session))
-
-**Property 10.2: Report Uniqueness**
-- **Validates**: Requirements 7.5
-- **Property**: Each report has a unique identifier
-- **Formal**: ∀ report1, report2: report1 ≠ report2 ⇒ report1.id ≠ report2.id
-
-## 13. Testing Framework
-
-### 13.1 Property-Based Testing Framework
-- **Framework**: JUnit 5 + jqwik (Java property-based testing)
-- **Test Organization**: Co-located with source files using `.test.java` suffix
-- **Annotation Format**: `// Validates: Requirements X.Y`
-
-### 13.2 Test Generators
-- **Message Generator**: Generates realistic scam messages with varying obfuscation
-- **UPI ID Generator**: Generates valid and invalid UPI ID formats
-- **Session Generator**: Generates conversation sessions with varying lengths
-- **Persona Generator**: Generates persona profiles with valid attributes
-
-### 13.3 Test Execution
-- **Unit Tests**: Run on every build
-- **Property Tests**: Run with configurable iteration count (default: 100)
-- **Integration Tests**: Run in CI/CD pipeline
-- **Simulation Tests**: Run for end-to-end validation
-
-## 14. Compliance and Legal
-
-### 14.1 Data Retention
-- Evidence retention policy
-- Automatic cleanup after reporting
-- Compliance with data protection regulations
-
-### 14.2 Government Reporting
-- Mandatory reporting thresholds
-- Report format compliance
-- Submission confirmation tracking
-
-### 14.3 Privacy Considerations
-- Scammer data handling
-- User data protection (WhatsApp integration)
-- Data anonymization for analytics
diff --git a/.kiro/specs/varutri-command-center/requirements.md b/.kiro/specs/varutri-command-center/requirements.md
deleted file mode 100644
index 0f3723b..0000000
--- a/.kiro/specs/varutri-command-center/requirements.md
+++ /dev/null
@@ -1,246 +0,0 @@
-# Requirements Document: Varutri AI-Powered Active Defense & Threat Intelligence Ecosystem
-
-## Introduction
-
-Varutri is an AI-Powered Active Defense & Threat Intelligence Ecosystem that transforms cybersecurity from passive blocking to active engagement. Unlike traditional tools that only block attacks, Varutri invites and engages scammers through hyper-realistic AI personas acting as sophisticated digital decoys (Honeypots). The system wastes scammers' time, depletes their resources, and extracts valuable intelligence about their tactics, payment methods, and infrastructure.
-
-### Problem Statement
-
-1. **Rapid Evolution**: Scammers evolve faster than static filters (e.g., new UPI refund scams, AI voice cloning)
-2. **Passive Defense Limitations**: Traditional blocking isn't enough; we need to understand the intent and methodology of attackers
-3. **Resource Asymmetry**: Scammers jeopardize millions with low effort. We need to increase the cost of their attacks
-
-### Solution
-
-Varutri Command Center provides:
-- **Defensive Deception**: An autonomous system that fights back by engaging scammers in endless, realistic conversations
-- **Holistic Intelligence**: Combines real-time engagement data with web-scraped trend analysis
-- **Situational Awareness**: A unified dashboard for monitoring active threats and global scam metrics
-
-## Glossary
-
-- **Varutri_System**: The complete AI-powered active defense and threat intelligence ecosystem
-- **Persona_Engine**: The AI service that generates and manages realistic conversational personas
-- **Threat_Detector**: The multi-layer threat detection pipeline that analyzes messages for scam indicators
-- **Intelligence_Extractor**: The component that identifies and extracts actionable intelligence (UPI IDs, phone numbers, URLs, etc.)
-- **Evidence_Store**: MongoDB-based persistent storage for conversation history and threat intelligence
-- **Ensemble_Scorer**: The unified threat assessment system that combines all detection layers
-- **Session**: A unique conversation thread between a persona and a potential scammer
-- **Threat_Level**: A normalized score (0.0-1.0) indicating the likelihood of malicious intent
-- **LLM**: Large Language Model used for persona generation (HuggingFace Llama 3.3 70B or Ollama)
-- **UPI_ID**: Unified Payments Interface identifier used in Indian digital payments
-- **IFSC_Code**: Indian Financial System Code for bank identification
-- **Scam_Type**: Classification of scam methodology (INVESTMENT, LOTTERY, TECH_SUPPORT, PHISHING, JOB_SCAM)
-
-## Requirements
-
-### Requirement 1: AI Persona Management
-
-**User Story:** As a cybersecurity defender, I want the system to generate and maintain realistic AI personas, so that scammers believe they are interacting with real victims and continue engaging.
-
-#### Acceptance Criteria
-
-1. THE Persona_Engine SHALL maintain configurable persona profiles with name, age, occupation, personality traits, language style, and tech-savviness level
-2. WHEN a new conversation session starts, THE Persona_Engine SHALL generate contextually appropriate responses using the configured LLM
-3. THE Persona_Engine SHALL support multiple LLM backends including HuggingFace API and Ollama
-4. WHEN generating responses, THE Persona_Engine SHALL incorporate persona characteristics to maintain consistent personality and behavior patterns
-5. THE Persona_Engine SHALL support dynamic persona configuration without requiring system restart
-
-### Requirement 2: Multi-Layer Threat Detection Pipeline
-
-**User Story:** As a threat analyst, I want the system to detect scam attempts through multiple detection layers, so that we can identify threats with high accuracy and low false positives.
-
-#### Acceptance Criteria
-
-1. WHEN a message is received, THE Threat_Detector SHALL process it through five sequential detection layers
-2. THE Threat_Detector SHALL normalize text in Layer 1 by detecting and converting leetspeak, homoglyphs, and obfuscation techniques
-3. THE Threat_Detector SHALL apply regex-based keyword matching in Layer 2 to identify known scam patterns
-4. THE Threat_Detector SHALL perform advanced pattern matching in Layer 3 using fuzzy matching, phonetic analysis, and n-gram detection
-5. THE Threat_Detector SHALL conduct semantic ML analysis in Layer 4 using embeddings, intent classification, and manipulation tactic detection
-6. THE Threat_Detector SHALL apply AI phishing model detection in Layer 5 to identify sophisticated phishing attempts
-7. THE Ensemble_Scorer SHALL combine results from all five layers to produce a unified threat assessment with calibrated confidence scores
-8. WHEN threat detection completes, THE Varutri_System SHALL return a Threat_Level score between 0.0 and 1.0
-
-### Requirement 3: Intelligence Extraction
-
-**User Story:** As a law enforcement officer, I want the system to automatically extract actionable intelligence from scammer conversations, so that I can identify and track malicious actors.
-
-#### Acceptance Criteria
-
-1. WHEN a message contains payment information, THE Intelligence_Extractor SHALL identify and extract UPI IDs in the format [digits]@[provider]
-2. WHEN a message contains banking information, THE Intelligence_Extractor SHALL extract bank account numbers and IFSC_Code values
-3. WHEN a message contains contact information, THE Intelligence_Extractor SHALL extract phone numbers in Indian format
-4. WHEN a message contains web references, THE Intelligence_Extractor SHALL extract URLs and email addresses
-5. THE Intelligence_Extractor SHALL identify and extract suspicious keywords and scam pattern indicators
-6. THE Intelligence_Extractor SHALL associate all extracted intelligence with the originating Session for traceability
-
-### Requirement 4: Evidence Collection and Storage
-
-**User Story:** As a cybersecurity investigator, I want the system to persistently store all conversation history and threat intelligence, so that I can analyze patterns and build cases against scammers.
-
-#### Acceptance Criteria
-
-1. THE Evidence_Store SHALL persist all conversation messages with timestamps, sender identification, and Session association
-2. WHEN threat analysis completes, THE Evidence_Store SHALL store the calculated Threat_Level for each message
-3. THE Evidence_Store SHALL classify and store the Scam_Type for each detected threat
-4. THE Evidence_Store SHALL store ensemble scoring results with confidence calibration data
-5. THE Evidence_Store SHALL support querying evidence by Session identifier
-6. THE Evidence_Store SHALL support filtering evidence by Threat_Level threshold
-7. WHEN evidence is stored, THE Varutri_System SHALL ensure data integrity and prevent tampering
-
-### Requirement 5: RESTful API Integration
-
-**User Story:** As a system integrator, I want the system to provide a secure RESTful API, so that I can integrate Varutri with external platforms and services.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL expose a POST endpoint at /api/chat for asynchronous message processing
-2. THE Varutri_System SHALL expose a POST endpoint at /api/assess for synchronous threat assessment
-3. THE Varutri_System SHALL expose a GET endpoint at /api/health for system health monitoring
-4. THE Varutri_System SHALL expose a GET endpoint at /api/evidence/{sessionId} for retrieving session-specific evidence
-5. THE Varutri_System SHALL expose a GET endpoint at /api/evidence/high-threat for retrieving high-risk evidence
-6. WHEN an API request is received, THE Varutri_System SHALL validate the API key before processing
-7. WHEN an API request is invalid, THE Varutri_System SHALL return appropriate HTTP status codes and error messages
-8. THE Varutri_System SHALL process chat requests asynchronously to prevent blocking
-
-### Requirement 6: WhatsApp Integration
-
-**User Story:** As a platform operator, I want the system to integrate with WhatsApp, so that we can engage scammers on their preferred communication channel.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL expose a POST endpoint at /api/whatsapp/webhook for receiving WhatsApp messages
-2. WHEN a WhatsApp message is received, THE Varutri_System SHALL extract the message content and sender information
-3. WHEN a WhatsApp message is processed, THE Varutri_System SHALL generate a persona-based response
-4. THE Varutri_System SHALL maintain separate Session tracking for each WhatsApp conversation
-5. WHEN responding to WhatsApp messages, THE Varutri_System SHALL format responses according to WhatsApp API requirements
-
-### Requirement 7: Government Reporting
-
-**User Story:** As a compliance officer, I want the system to support manual reporting to government authorities, so that we can fulfill legal obligations and support law enforcement.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL expose a POST endpoint at /api/report/manual for submitting manual reports
-2. WHEN a manual report is submitted, THE Varutri_System SHALL validate the report content and format
-3. THE Varutri_System SHALL associate manual reports with relevant Session and evidence data
-4. THE Varutri_System SHALL support callback mechanisms for external reporting systems
-5. WHEN a report is successfully submitted, THE Varutri_System SHALL return confirmation with report identifier
-
-### Requirement 8: Security and Authentication
-
-**User Story:** As a security administrator, I want the system to enforce strong authentication and security controls, so that only authorized users can access the API and sensitive data.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL require API key authentication for all API endpoints except health checks
-2. WHEN an API request lacks valid authentication, THE Varutri_System SHALL reject the request with HTTP 401 status
-3. THE Varutri_System SHALL implement rate limiting to prevent abuse and denial-of-service attacks
-4. WHEN input is received, THE Varutri_System SHALL sanitize and validate all user input to prevent injection attacks
-5. THE Varutri_System SHALL detect and reject prompt injection attempts in LLM interactions
-6. THE Varutri_System SHALL maintain secure session management with appropriate timeout policies
-7. THE Varutri_System SHALL log all authentication failures for security monitoring
-
-### Requirement 9: Performance and Scalability
-
-**User Story:** As a system operator, I want the system to handle high message volumes efficiently, so that we can engage multiple scammers simultaneously without degradation.
-
-#### Acceptance Criteria
-
-1. WHEN processing chat requests, THE Varutri_System SHALL handle requests asynchronously to prevent blocking
-2. THE Varutri_System SHALL support concurrent processing of multiple Session conversations
-3. WHEN under load, THE Varutri_System SHALL maintain response times within acceptable thresholds
-4. THE Varutri_System SHALL implement connection pooling for database operations
-5. THE Varutri_System SHALL support horizontal scaling through stateless API design
-6. WHEN rate limits are exceeded, THE Varutri_System SHALL queue requests rather than rejecting them
-
-### Requirement 10: Scam Type Classification
-
-**User Story:** As a threat analyst, I want the system to automatically classify scam types, so that I can understand attack patterns and trends.
-
-#### Acceptance Criteria
-
-1. WHEN a threat is detected, THE Varutri_System SHALL classify it into one of the defined Scam_Type categories
-2. THE Varutri_System SHALL support classification of INVESTMENT scams
-3. THE Varutri_System SHALL support classification of LOTTERY scams
-4. THE Varutri_System SHALL support classification of TECH_SUPPORT scams
-5. THE Varutri_System SHALL support classification of PHISHING scams
-6. THE Varutri_System SHALL support classification of JOB_SCAM attempts
-7. WHEN a scam matches multiple categories, THE Varutri_System SHALL assign the most specific applicable Scam_Type
-
-### Requirement 11: System Health Monitoring
-
-**User Story:** As a DevOps engineer, I want the system to provide health status information, so that I can monitor system availability and diagnose issues.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL expose a GET endpoint at /api/health that returns system health status
-2. WHEN the health endpoint is queried, THE Varutri_System SHALL verify database connectivity
-3. WHEN the health endpoint is queried, THE Varutri_System SHALL verify LLM service availability
-4. WHEN all components are operational, THE Varutri_System SHALL return HTTP 200 status
-5. WHEN any critical component is unavailable, THE Varutri_System SHALL return HTTP 503 status with component details
-6. THE Varutri_System SHALL not require authentication for health check endpoints
-
-### Requirement 12: Configuration Management
-
-**User Story:** As a system administrator, I want the system to support external configuration, so that I can adjust behavior without code changes.
-
-#### Acceptance Criteria
-
-1. THE Varutri_System SHALL load configuration from external sources (environment variables, configuration files)
-2. THE Varutri_System SHALL support configuration of LLM provider selection (HuggingFace or Ollama)
-3. THE Varutri_System SHALL support configuration of API keys and authentication credentials
-4. THE Varutri_System SHALL support configuration of rate limiting thresholds
-5. THE Varutri_System SHALL support configuration of threat detection sensitivity levels
-6. THE Varutri_System SHALL support configuration of MongoDB connection parameters
-7. WHEN configuration is invalid, THE Varutri_System SHALL fail startup with clear error messages
-
-### Requirement 13: Ensemble Threat Scoring
-
-**User Story:** As a threat analyst, I want the system to provide unified threat scores with confidence calibration, so that I can prioritize high-confidence threats.
-
-#### Acceptance Criteria
-
-1. THE Ensemble_Scorer SHALL combine threat scores from all five detection layers
-2. THE Ensemble_Scorer SHALL apply weighted scoring based on layer reliability
-3. THE Ensemble_Scorer SHALL calibrate confidence scores to reduce false positives
-4. WHEN multiple layers disagree, THE Ensemble_Scorer SHALL apply conflict resolution logic
-5. THE Ensemble_Scorer SHALL produce a final Threat_Level score between 0.0 and 1.0
-6. THE Ensemble_Scorer SHALL provide confidence intervals for threat assessments
-7. WHEN threat scoring completes, THE Ensemble_Scorer SHALL include layer-specific contributions in the result
-
-### Requirement 14: Text Normalization and Obfuscation Detection
-
-**User Story:** As a threat analyst, I want the system to detect and normalize obfuscated text, so that scammers cannot evade detection through text manipulation.
-
-#### Acceptance Criteria
-
-1. WHEN text contains leetspeak (e.g., "h3ll0"), THE Threat_Detector SHALL convert it to standard characters
-2. WHEN text contains homoglyphs (e.g., Cyrillic 'а' instead of Latin 'a'), THE Threat_Detector SHALL normalize to standard Unicode
-3. WHEN text contains zero-width characters or invisible obfuscation, THE Threat_Detector SHALL remove them
-4. WHEN text contains excessive spacing or formatting, THE Threat_Detector SHALL normalize whitespace
-5. THE Threat_Detector SHALL preserve original text for evidence while using normalized text for analysis
-
-### Requirement 15: Advanced Pattern Matching
-
-**User Story:** As a threat analyst, I want the system to detect scam patterns using fuzzy matching and phonetic analysis, so that we can identify variations and misspellings of known scam indicators.
-
-#### Acceptance Criteria
-
-1. WHEN analyzing text, THE Threat_Detector SHALL apply fuzzy string matching to detect near-matches of known scam keywords
-2. THE Threat_Detector SHALL apply phonetic analysis to detect sound-alike variations of scam terms
-3. THE Threat_Detector SHALL use n-gram analysis to detect partial matches and word fragments
-4. WHEN a fuzzy match is detected, THE Threat_Detector SHALL calculate a similarity score
-5. THE Threat_Detector SHALL support configurable similarity thresholds for pattern matching
-
-### Requirement 16: Semantic Analysis and Intent Detection
-
-**User Story:** As a threat analyst, I want the system to understand the semantic meaning and intent of messages, so that we can detect sophisticated scams that evade keyword-based detection.
-
-#### Acceptance Criteria
-
-1. WHEN analyzing text, THE Threat_Detector SHALL generate semantic embeddings for contextual understanding
-2. THE Threat_Detector SHALL classify message intent to identify manipulation tactics
-3. THE Threat_Detector SHALL detect urgency indicators and pressure tactics commonly used in scams
-4. THE Threat_Detector SHALL identify trust exploitation patterns in message content
-5. THE Threat_Detector SHALL detect financial solicitation patterns regardless of specific wording
diff --git a/CONSUMER_ARCHITECTURE.md b/CONSUMER_ARCHITECTURE.md
index 266121f..247ac21 100644
--- a/CONSUMER_ARCHITECTURE.md
+++ b/CONSUMER_ARCHITECTURE.md
@@ -15,6 +15,7 @@ Channels in MVP:
 Client surfaces:
 - Flutter mobile app shell (`consumer_app`)
 - Browser extension shell (`consumer_extension`)
+- Web command center (`frontend`)
 
 Server surface:
 - Spring Boot consumer APIs under `/api/consumer/**`
@@ -22,30 +23,30 @@ Server surface:
 ## 2) HLD (High-Level Design)
 
 ```text
-+-----------------------+      +-----------------------+
-| Flutter Consumer App  |      | Browser Extension     |
-| - capture/share flow  |      | - active tab analysis |
-| - risk presence UI    |      | - page risk banner    |
-+-----------+-----------+      +-----------+-----------+
-            |                              |
-            | Bearer token + payload       | Bearer token + payload
-            +---------------+--------------+
-                            |
-                            v
-                 +--------------------------+
-                 | Spring Boot Consumer API |
-                 | /auth /analyze /history  |
-                 | /capabilities            |
-                 +------------+-------------+
-                              |
-           +------------------+-------------------+
-           |                                      |
-           v                                      v
-+------------------------+              +------------------------+
-| Threat + Extraction    |              | Session + Evidence DB  |
-| ensemble scorer        |              | Mongo repositories     |
-| info extractor         |              | history and detail     |
-+------------------------+              +------------------------+
++-----------------------+      +-----------------------+      +-----------------------+
+| Flutter Consumer App  |      | Browser Extension     |      | Web Command Center    |
+| - capture/share flow  |      | - active tab analysis |      | - ops and drill-down  |
+| - risk presence UI    |      | - page risk banner    |      | - manual triage flow  |
++-----------+-----------+      +-----------+-----------+      +-----------+-----------+
+    |                              |                              |
+    | Bearer token + payload       | Bearer token + payload       | Bearer token + payload
+    +---------------+--------------+--------------+---------------+
+                |
+                v
+             +--------------------------+
+             | Spring Boot Consumer API |
+             | /auth /analyze /history  |
+             | /capabilities            |
+             +------------+-------------+
+                  |
+         +----------------------------+----------------------------+
+         |                                                         |
+         v                                                         v
+  +------------------------+                               +------------------------+
+  | Threat + Extraction    |                               | Session + Evidence DB  |
+  | ensemble scorer        |                               | Mongo repositories     |
+  | info extractor         |                               | history and detail     |
+  +------------------------+                               +------------------------+
 ```
 
 ## 3) LLD (Low-Level Design)
@@ -107,6 +108,15 @@ Server surface:
 - `popup.js`
   - Management panel for config + action flow.
 
+### 3.4 Client Components (Web Command Center)
+
+- `frontend/index.html`
+  - End-to-end flow board for token, analysis, history, capabilities, and detail.
+- `frontend/app.js`
+  - API integration, state management, and client-side TTL cache.
+- `frontend/style.css`
+  - Responsive on-screen risk presence and flow-oriented visual system.
+
 ## 4) Flow Structures
 
 ### 4.1 Flow A: Token Provisioning
@@ -142,17 +152,21 @@ Server surface:
 
 ### 5.1 Server-Side Cache
 
-Current implementation (in-memory TTL):
+Current implementation (backend-selectable TTL cache):
+- Backend mode: `consumer.cache.backend=MEMORY|REDIS|HYBRID`
+- Cache key prefix: `consumer.cache.key-prefix`
 - History list TTL: `consumer.cache.history.ttl-seconds` (default 45)
 - History detail TTL: same history TTL bucket
 - Capability TTL: `consumer.cache.capabilities.ttl-seconds` (default 300)
+- Redis connection (when backend uses Redis): `spring.data.redis.*`
 
 Invalidation policy:
-- On new analysis write, clear history list cache and matching session detail key.
+- On new analysis write, cache service increments distributed history cache version.
+- New keys are generated under the next history version to invalidate stale entries across instances.
 
-Production recommendation:
-- Move to Redis for horizontal scale.
-- Add cache metrics (`hit`, `miss`, `eviction`) and alerts.
+Operational note:
+- Redis failures gracefully degrade to in-memory fallback so API flow remains available.
+- Cache metrics (`hit`, `miss`, `write`, `invalidate`, `fallback`) are emitted under `varutri.consumer.cache.operations`.
 
 ### 5.2 Client-Side Cache
 
@@ -193,8 +207,8 @@ On-screen presence is always derived from latest threat output:
 
 Release tracks:
 1. Track A (complete): Consumer API + token + history + capability matrix.
-2. Track B (in progress): Rich client flows + extension shell + risk presence.
-3. Track C: Native capture modules and provider integrations (SMS roles, Call screening, OAuth email).
+2. Track B (complete): Flutter state flow + extension shell + web command center + risk presence.
+3. Track C (in progress): Native capture modules and provider integrations (SMS roles, Call screening, OAuth email).
 
 Runbook checks per release:
 - API token issuance smoke test
@@ -210,7 +224,6 @@ SLO targets (initial):
 
 ## 9) Next Engineering Steps
 
-- Add Redis-backed cache implementation behind `ConsumerCacheService` interface.
-- Add telemetry: request IDs, cache metrics, per-channel latency.
+- Add telemetry: request IDs and per-channel latency traces.
 - Introduce persistent risk feed stream for real-time app/extension presence.
-- Add CI checks for extension lint + Flutter static analysis once toolchains are available in CI image.
+- Expand CI with Flutter static analysis once Flutter SDK is available in CI image.
diff --git a/QUICKSTART.md b/QUICKSTART.md
index f91e68b..5716482 100644
--- a/QUICKSTART.md
+++ b/QUICKSTART.md
@@ -18,6 +18,17 @@ mvn clean package -DskipTests
 java -jar target/honeypot-1.0.0.jar
 ```
 
+Optional Redis cache mode for horizontal scale:
+
+```bash
+docker compose up -d redis
+export CONSUMER_CACHE_BACKEND=REDIS
+export REDIS_HOST=localhost
+export REDIS_PORT=6379
+export REDIS_PASSWORD=change_me
+export REDIS_SSL_ENABLED=false
+```
+
 ## Testing the API
 
 ```bash
@@ -90,4 +101,18 @@ Provide the ngrok HTTPS URL to GUVI platform.
 - All code pushed to: https://github.com/SahilKumar75/Varutri-Honeypot
 - Consumer app shell: `consumer_app/`
 - Browser extension shell: `consumer_extension/`
+- Web command center: `frontend/`
 - HLD/LLD + flow architecture doc: `CONSUMER_ARCHITECTURE.md`
+
+Open the web command center:
+
+```bash
+cd frontend
+open index.html
+```
+
+CI pipeline is available in `.github/workflows/ci.yml` and runs:
+- `mvn -DskipTests compile`
+- JS syntax checks for frontend and extension
+- shell script syntax checks
+- Docker Compose config validation
diff --git a/README.md b/README.md
index acbb5b5..e9d1b87 100644
--- a/README.md
+++ b/README.md
@@ -131,6 +131,7 @@ See [AZURE_QUICKSTART.md](AZURE_QUICKSTART.md) for details.
 
 - Flutter consumer shell: [consumer_app/README.md](consumer_app/README.md)
 - Browser extension shell: [consumer_extension/README.md](consumer_extension/README.md)
+- Web command center: [frontend/README.md](frontend/README.md)
 - HLD/LLD and flow architecture: [CONSUMER_ARCHITECTURE.md](CONSUMER_ARCHITECTURE.md)
 
 #### Render
@@ -142,5 +143,16 @@ Key settings in `application.properties`:
 - `llm.provider`: `huggingface` or `ollama`
 - `huggingface.api-key`: Your HF API key
 - `varutri.api-key`: API key for requests
+- `consumer.cache.backend`: `MEMORY`, `REDIS`, or `HYBRID`
+- `spring.data.redis.*`: Redis host/port/password/database for distributed cache mode
+- `spring.data.redis.ssl.enabled`: Toggle TLS for managed Redis providers
 - `hackathon.callback-url`: GUVI callback endpoint
 - `varutri.session.max-turns`: Max conversation turns (default: 40)
+
+## Production Cache Checklist
+
+- Set `CONSUMER_CACHE_BACKEND=REDIS` (or `HYBRID` for local fallback mode).
+- Configure `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD`, and optional `REDIS_USERNAME`.
+- For managed Redis over TLS set `REDIS_SSL_ENABLED=true`.
+- Cache operation metrics are exported via actuator metric key:
+	- `varutri.consumer.cache.operations`
diff --git a/compile_output.txt b/compile_output.txt
deleted file mode 100644
index 8b24457bd62157832bc28019b2be35206ac06d63..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1928
zcmdUvTT25m5QWdP;D5-YA}zg8ks>0k76qvft-iEAly>cf-e_0RKd*k1rQ(`G*#{K~
z$<9tPGiT;Z^8VJ*wVG<^Ru6J&sjr^qj4^YF=1~i+_%2x&nkeE#thMrf>}yYH51}Tf
zY~z$@ePYds@C=%jo`|>tQB@=Kb1=MuXMxt~ETi|FLWDIUj5XEZGwb_QT&JrbZV_|^
zKSO`c*UjoR^OZ|-dEsxmC3?2%gr_^in0UMn4#WMdnlPVGllXM76446_>bHV3ldCFI
z6`MumaNp^GI!E+X534C0=C+(VB&Ty`$afMsL{taGlD^pVZ4vA5(XE>|tgMmx>cUCS
z+jN7|Ydpkwwbi<C2<jM%KB#+Sy7u|*MpF1QBq6p9Z^`{y`mT@2En%(bc`NXj-rvSq
z`b2iVnp8H1-wj_$rPE#=z2T_!lwohe*SeeD_;qyAk~Og(ppDVyf8d^Fy+^ywhwRjJ
z$7_6}3-W0p*BO^ct$&$K+cRwJ89QTcT102r+h}j+i7HITEeh+<@Le%xZ-mW&Q^u;<
nmUweZI;Jn|Yin6;q%ylD|Ke1TkI+}pl=+6<ck%Mu`-boXZ~+3j

diff --git a/docker-compose.yml b/docker-compose.yml
index a69452d..77749ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   app:
     container_name: varutri_honeypot
@@ -14,6 +12,16 @@ services:
       - WHATSAPP_API_TOKEN=${WHATSAPP_API_TOKEN}
       - WHATSAPP_PHONE_NUMBER_ID=${WHATSAPP_PHONE_NUMBER_ID}
       - WHATSAPP_VERIFY_TOKEN=${WHATSAPP_VERIFY_TOKEN}
+      - CONSUMER_CACHE_BACKEND=${CONSUMER_CACHE_BACKEND:-REDIS}
+      - CONSUMER_CACHE_KEY_PREFIX=${CONSUMER_CACHE_KEY_PREFIX:-varutri:consumer}
+      - REDIS_HOST=${REDIS_HOST:-redis}
+      - REDIS_PORT=${REDIS_PORT:-6379}
+      - REDIS_USERNAME=${REDIS_USERNAME:-}
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+      - REDIS_DATABASE=${REDIS_DATABASE:-0}
+      - REDIS_SSL_ENABLED=${REDIS_SSL_ENABLED:-false}
+    depends_on:
+      - redis
     restart: unless-stopped
     # If you want to run MongoDB locally as a container, uncomment the 'depends_on' and 'mongodb' service below.
     # However, for AWS Free Tier (EC2 t2.micro/t3.micro), we recommend using MongoDB Atlas (cloud) 
@@ -21,6 +29,26 @@ services:
 #     depends_on:
 #       - mongodb
 
+  redis:
+    image: redis:7-alpine
+    container_name: varutri_redis
+    command:
+      - sh
+      - -c
+      - |
+        if [ -n "$REDIS_PASSWORD" ]; then
+          exec redis-server --appendonly yes --requirepass "$REDIS_PASSWORD"
+        else
+          exec redis-server --appendonly yes
+        fi
+    environment:
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    restart: unless-stopped
+
 #   mongodb:
 #     image: mongo:latest
 #     container_name: mongodb
@@ -32,3 +60,6 @@ services:
 
 # volumes:
 #   mongo_data:
+
+volumes:
+  redis_data:
diff --git a/frontend/README.md b/frontend/README.md
index f42afc6..60bbf53 100644
--- a/frontend/README.md
+++ b/frontend/README.md
@@ -1,131 +1,42 @@
-# Varutri Honeypot Terminal Dashboard
+# Varutri Consumer Command Center (Web)
 
-## Hacker-Style Monitoring Interface
+This frontend is now a consumer-facing command center wired to the real consumer APIs.
 
-A cyberpunk-themed terminal dashboard for monitoring scam conversations in real-time.
+## Flows Included
 
-## Features
+1. Server boundary and token issuance
+   - `POST /api/consumer/auth/token`
+2. Suspicious signal analysis
+   - `POST /api/consumer/analyze`
+3. Evidence timeline list and detail drill-down
+   - `GET /api/consumer/history`
+   - `GET /api/consumer/history/{sessionId}`
+4. Platform capability matrix and constraints
+   - `GET /api/consumer/capabilities?platform=...`
 
-### Left Panel: Conversation Monitor
-- Live chat feed showing scammer messages and AI responses
-- Color-coded messages (Red = Scammer, Green = AI, Gray = System)
-- Input field to simulate scammer messages
-- Scrollable conversation history
+## UX Highlights
 
-### Right Panel: Threat Analysis
-- **Threat Meter**: Visual bar showing threat level (0-100%)
-  - Green (0-40%): Safe
-  - Yellow (40-70%): Medium Threat
-  - Red (70-100%): High Threat
-- **Scam Type Detection**: Shows detected scam category
-- **Intelligence Extracted**: Real-time list of:
-  -  UPI IDs
-  -  Bank Accounts
-  -  Phone Numbers
-  -  Phishing URLs
-  -  Suspicious Keywords
-- **Session Stats**: Message count and turn count
-- **Quick Actions**:
-  - Run Tests
-  - Generate Report
-  - Reset Session
+- On-screen risk presence states: Idle, Safe, Watch, Danger
+- Channel-aware analysis input (`SMS`, `CALL`, `WHATSAPP`, `EMAIL`, `BROWSER`, `MANUAL`, `PROMPT`)
+- Client-side TTL cache for history, detail, and capabilities
+- Responsive layout for desktop and mobile
 
-## How to Use
+## Local Run
 
-### 1. Start Backend
-```bash
-cd /Users/sahilkumarsingh/Desktop/Varutri-Honeypot
-java -jar target/honeypot-1.0.0.jar
-```
+1. Start backend (`mvn spring-boot:run`)
+2. Open frontend:
 
-### 2. Open Frontend
 ```bash
 cd frontend
 open index.html
-# Or just double-click index.html
-```
-
-### 3. Simulate Scammer
-Type scammer messages in the input field:
-```
-You won 10 lakh rupees! Send to 9876543210@paytm
 ```
 
-Watch as:
-- AI responds with elderly persona
-- Threat level increases
-- Intelligence gets extracted
-- Stats update in real-time
-
-### 4. Run Tests
-Click "RUN TESTS" to execute all 5 scam scenarios automatically
-
-### 5. Generate Report
-Click "GENERATE REPORT" to create government report for current session
-
-## Design
-
-- **Theme**: Cyberpunk/Matrix green terminal
-- **Font**: Courier New (monospace)
-- **Colors**:
-  - Background: Dark blue (#0a0e27)
-  - Primary: Matrix green (#00ff41)
-  - Danger: Red (#ff4444)
-  - Warning: Yellow (#ffff00)
-- **Animations**:
-  - Pulsing status indicator
-  - Scanning threat meter
-  - Glowing text effects
-  - Smooth message transitions
-
-## API Integration
-
-Connects to your Spring Boot backend:
-- `POST /api/chat` - Send scammer messages
-- `GET /api/evidence/{sessionId}` - Get threat data
-- `POST /api/test/run-all` - Run test scenarios
-- `POST /api/report/manual` - Generate reports
-- `GET /api/report/stats` - Get statistics
-
-## Files
-
-```
-frontend/
-├── index.html    # Main dashboard structure
-├── style.css     # Cyberpunk styling
-├── app.js        # API integration & logic
-└── README.md     # This file
-```
-
-## Customization
-
-### Change API URL
-Edit `app.js`:
-```javascript
-const API_URL = 'https://your-render-url.com';
-```
-
-### Adjust Colors
-Edit `style.css`:
-```css
---primary-color: #00ff41;  /* Change to your color */
-```
-
-## Demo Flow
-
-1. Type: `Hello sir, you won lottery of 50 lakh rupees!`
-2. Watch AI respond: `Arrey beta! 50 lakh? But I am old person...`
-3. Type: `Send OTP to 9876543210@paytm to claim`
-4. See threat level jump to 80%
-5. See UPI ID extracted in right panel
-6. Click "GENERATE REPORT"
-
-## Screenshots
+3. In the UI:
+   - Confirm Base URL (`http://localhost:8080`)
+   - Click **Issue Token**
+   - Run analysis and inspect timeline/capabilities
 
-The terminal shows:
-- Live conversation on left
-- Animated threat meter on right
-- Real-time intelligence extraction
-- Glowing green matrix aesthetic
+## Notes
 
-Perfect for hackathon demos! 
+- This is a production-oriented integration surface for end-to-end flow testing.
+- Browser CORS/security policies still apply when opening from file protocol; if needed, host the folder via a lightweight static server.
diff --git a/frontend/app.js b/frontend/app.js
index 266bb73..d62ab23 100644
--- a/frontend/app.js
+++ b/frontend/app.js
@@ -1,527 +1,722 @@
-// Configuration
-const API_URL = 'https://varutri-honeypot.onrender.com';
-const API_KEY = 'varutri_shield_2026';
-
-// State
-let currentSessionId = null;
-let activeSessions = [];
-let recentSessions = [];
-
-// Initialize
-window.onload = () => {
-    updateTimestamp();
-    setInterval(updateTimestamp, 1000);
-    loadSessions();
-    loadStats();
-
-    // Refresh sessions every 5 seconds
-    setInterval(loadSessions, 5000);
-
-    // Event delegation for session card clicks
-    document.getElementById('activeSessions').addEventListener('click', handleSessionClick);
-    document.getElementById('recentSessions').addEventListener('click', handleSessionClick);
+const STORAGE_KEY = 'varutri.consumer.web.config.v1';
+
+const DEFAULT_CONFIG = {
+    baseUrl: 'http://localhost:8080',
+    appId: 'varutri-web',
+    deviceId: `web-${Math.random().toString(36).slice(2, 10)}`,
+    appVersion: '0.2.0',
+    platform: 'WEB',
 };
 
-// Handle session card click
-function handleSessionClick(event) {
-    const card = event.target.closest('.session-card');
-    if (card) {
-        const sessionId = card.dataset.sessionId;
-        console.log('Card clicked, session ID:', sessionId);
-        if (sessionId) {
-            viewSession(sessionId);
-        }
-    }
-}
+const CACHE_TTL_MS = {
+    history: 30_000,
+    detail: 120_000,
+    capabilities: 300_000,
+};
 
-// Update timestamp
-function updateTimestamp() {
-    const now = new Date();
-    const timestamp = now.toLocaleString('en-US', {
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        second: '2-digit',
-        hour12: false
-    });
-    document.getElementById('timestamp').textContent = `Last Sync: ${timestamp}`;
+const state = {
+    config: { ...DEFAULT_CONFIG },
+    auth: null,
+    channel: 'SMS',
+    status: 'Ready',
+    statusLevel: 'info',
+    latestAnalysis: null,
+    history: [],
+    selectedDetail: null,
+    capabilities: null,
+    loading: {
+        token: false,
+        analyze: false,
+        history: false,
+        detail: false,
+        capabilities: false,
+    },
+    cache: {
+        history: null,
+        capabilitiesByPlatform: new Map(),
+        detailsBySession: new Map(),
+    },
+};
+
+const dom = {};
+
+window.addEventListener('DOMContentLoaded', bootstrap);
+
+function bootstrap() {
+    cacheDom();
+    hydrateConfig();
+    bindEvents();
+    tickClock();
+    setInterval(tickClock, 1000);
+    renderAll();
 }
 
-// Load sessions
-async function loadSessions() {
-    try {
-        // Try to fetch sessions from API
-        const response = await fetch(`${API_URL}/api/sessions/active`, {
-            headers: { 'x-api-key': API_KEY }
-        });
+function cacheDom() {
+    dom.connectionForm = document.getElementById('connectionForm');
+    dom.analyzeForm = document.getElementById('analyzeForm');
+    dom.baseUrlInput = document.getElementById('baseUrlInput');
+    dom.appIdInput = document.getElementById('appIdInput');
+    dom.deviceIdInput = document.getElementById('deviceIdInput');
+    dom.appVersionInput = document.getElementById('appVersionInput');
+    dom.platformSelect = document.getElementById('platformSelect');
+    dom.channelSelect = document.getElementById('channelSelect');
+    dom.contentInput = document.getElementById('contentInput');
+    dom.senderInput = document.getElementById('senderInput');
+    dom.urlInput = document.getElementById('urlInput');
+
+    dom.issueTokenBtn = document.getElementById('issueTokenBtn');
+    dom.loadCapabilitiesBtn = document.getElementById('loadCapabilitiesBtn');
+    dom.analyzeBtn = document.getElementById('analyzeBtn');
+    dom.refreshHistoryBtn = document.getElementById('refreshHistoryBtn');
+
+    dom.presenceChip = document.getElementById('presenceChip');
+    dom.tokenChip = document.getElementById('tokenChip');
+    dom.clockChip = document.getElementById('clockChip');
+    dom.tokenExpiryText = document.getElementById('tokenExpiryText');
+    dom.presencePanel = document.getElementById('presencePanel');
+    dom.presenceTitle = document.getElementById('presenceTitle');
+    dom.presenceNote = document.getElementById('presenceNote');
+    dom.latestAnalysisSummary = document.getElementById('latestAnalysisSummary');
+
+    dom.analysisContent = document.getElementById('analysisContent');
+    dom.historyList = document.getElementById('historyList');
+    dom.capabilitiesSummary = document.getElementById('capabilitiesSummary');
+    dom.capabilitiesList = document.getElementById('capabilitiesList');
+    dom.detailContainer = document.getElementById('detailContainer');
+
+    dom.statusText = document.getElementById('statusText');
+    dom.cacheStatus = document.getElementById('cacheStatus');
+}
 
-        if (response.ok) {
-            const sessions = await response.json();
+function bindEvents() {
+    dom.connectionForm.addEventListener('submit', async (event) => {
+        event.preventDefault();
+        syncConfigFromForm();
+        await issueToken();
+    });
 
-            // Separate active and recent sessions
-            activeSessions = sessions.filter(s => s.status === 'active');
-            recentSessions = sessions.filter(s => s.status === 'completed').slice(0, 10);
+    dom.loadCapabilitiesBtn.addEventListener('click', async () => {
+        syncConfigFromForm();
+        await loadCapabilities({ forceRefresh: true });
+    });
 
-            console.log('Loaded from API:', activeSessions.length, 'active,', recentSessions.length, 'recent');
-        } else {
-            throw new Error('API returned ' + response.status);
-        }
+    dom.refreshHistoryBtn.addEventListener('click', async () => {
+        await loadHistory({ forceRefresh: true });
+    });
 
-    } catch (error) {
-        console.log('API unavailable, using demo sessions');
-
-        // Fallback to demo sessions with STABLE IDs
-        if (activeSessions.length === 0) {
-            activeSessions = [
-                {
-                    id: 'session-active-001',
-                    channel: 'WHATSAPP',
-                    scamType: 'LOTTERY_SCAM',
-                    threatLevel: 0.85,
-                    messages: 12,
-                    aiResponses: 6,
-                    startTime: new Date(Date.now() - 300000),
-                    status: 'active'
-                }
-            ];
-        }
+    dom.analyzeForm.addEventListener('submit', async (event) => {
+        event.preventDefault();
+        syncConfigFromForm();
+        state.channel = dom.channelSelect.value;
+        await runAnalysis();
+    });
 
-        if (recentSessions.length === 0) {
-            recentSessions = [
-                {
-                    id: 'session-recent-001',
-                    channel: 'WHATSAPP',
-                    scamType: 'BANK_SCAM',
-                    threatLevel: 0.72,
-                    messages: 18,
-                    aiResponses: 9,
-                    startTime: new Date(Date.now() - 3600000),
-                    status: 'completed'
-                },
-                {
-                    id: 'session-recent-002',
-                    channel: 'TELEGRAM',
-                    scamType: 'JOB_SCAM',
-                    threatLevel: 0.45,
-                    messages: 8,
-                    aiResponses: 4,
-                    startTime: new Date(Date.now() - 7200000),
-                    status: 'completed'
-                }
-            ];
+    dom.historyList.addEventListener('click', async (event) => {
+        const item = event.target.closest('[data-session-id]');
+        if (!item) {
+            return;
         }
-    }
+        await loadHistoryDetail(item.dataset.sessionId, { forceRefresh: false });
+    });
 
-    renderSessions();
+    dom.platformSelect.addEventListener('change', () => {
+        state.capabilities = null;
+        renderCapabilities();
+    });
 }
 
-// Render sessions
-function renderSessions() {
-    // Active sessions
-    const activeContainer = document.getElementById('activeSessions');
-    document.getElementById('activeCount').textContent = activeSessions.length;
-
-    if (activeSessions.length === 0) {
-        activeContainer.innerHTML = '<div class="empty-state">No active sessions</div>';
-    } else {
-        activeContainer.innerHTML = activeSessions.map(session => createSessionCard(session)).join('');
+function hydrateConfig() {
+    try {
+        const stored = localStorage.getItem(STORAGE_KEY);
+        if (stored) {
+            const parsed = JSON.parse(stored);
+            state.config = { ...DEFAULT_CONFIG, ...parsed };
+        }
+    } catch (error) {
+        setStatus(`Config restore failed: ${error.message}`, 'warning');
     }
 
-    // Recent sessions
-    const recentContainer = document.getElementById('recentSessions');
-    document.getElementById('recentCount').textContent = recentSessions.length;
-
-    if (recentSessions.length === 0) {
-        recentContainer.innerHTML = '<div class="empty-state">No recent sessions</div>';
-    } else {
-        recentContainer.innerHTML = recentSessions.map(session => createSessionCard(session)).join('');
-    }
+    dom.baseUrlInput.value = state.config.baseUrl;
+    dom.appIdInput.value = state.config.appId;
+    dom.deviceIdInput.value = state.config.deviceId;
+    dom.appVersionInput.value = state.config.appVersion;
+    dom.platformSelect.value = state.config.platform;
+    dom.channelSelect.value = state.channel;
 }
 
-// Create session card HTML
-function createSessionCard(session) {
-    const threatPercent = Math.round(session.threatLevel * 100);
-    const threatClass = threatPercent < 40 ? 'low' : threatPercent < 70 ? 'medium' : 'high';
-    const duration = Math.round((Date.now() - session.startTime.getTime()) / 60000);
-
-    // Active sessions show UNKNOWN, completed sessions show actual type
-    const displayScamType = session.status === 'active' ? 'UNKNOWN' : session.scamType;
-    const displayThreat = session.status === 'active' ? 'ANALYZING...' : `${threatPercent}%`;
-
-    return `
-        <div class="session-card" data-session-id="${session.id}">
-            <div class="session-card-header">
-                <span class="session-id">${session.id.substring(0, 16)}...</span>
-                <span class="session-channel">${session.channel}</span>
-            </div>
-            <div class="session-card-body">
-                <div class="session-info-row">
-                    <span class="session-info-label">SCAM TYPE:</span>
-                    <span class="session-info-value">${displayScamType}</span>
-                </div>
-                <div class="session-info-row">
-                    <span class="session-info-label">MESSAGES:</span>
-                    <span class="session-info-value">${session.messages} (${session.aiResponses} AI)</span>
-                </div>
-                <div class="session-info-row">
-                    <span class="session-info-label">DURATION:</span>
-                    <span class="session-info-value">${duration}m</span>
-                </div>
-                <div class="session-threat">
-                    <div class="session-threat-bar">
-                        <div class="session-threat-fill ${threatClass}" style="width: ${session.status === 'active' ? '0' : threatPercent}%"></div>
-                    </div>
-                    <span class="session-threat-value ${threatClass}">${displayThreat}</span>
-                </div>
-            </div>
-        </div>
-    `;
+function syncConfigFromForm() {
+    state.config = {
+        baseUrl: dom.baseUrlInput.value.trim(),
+        appId: dom.appIdInput.value.trim(),
+        deviceId: dom.deviceIdInput.value.trim(),
+        appVersion: dom.appVersionInput.value.trim(),
+        platform: dom.platformSelect.value,
+    };
+
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(state.config));
 }
 
-// View session
-async function viewSession(sessionId) {
-    console.log('viewSession called with:', sessionId);
-    currentSessionId = sessionId;
+async function issueToken() {
+    setLoading('token', true);
+    setStatus('Requesting token...');
 
-    // Hide sessions view, show conversation view
-    document.getElementById('sessionsView').classList.add('hidden');
-    document.getElementById('conversationView').classList.remove('hidden');
+    try {
+        const response = await requestJson('/api/consumer/auth/token', {
+            method: 'POST',
+            body: {
+                appId: state.config.appId,
+                deviceId: state.config.deviceId,
+                platform: state.config.platform,
+                appVersion: state.config.appVersion,
+            },
+            auth: false,
+        });
 
-    // Update header
-    document.getElementById('currentSessionId').textContent = sessionId.substring(0, 20) + '...';
+        state.auth = response.data || null;
+        setStatus('Token issued successfully');
+        updateCacheStatus('token refresh');
 
-    // Find session
-    const session = [...activeSessions, ...recentSessions].find(s => s.id === sessionId);
-    console.log('Found session:', session);
-    if (session) {
-        document.getElementById('currentChannel').textContent = session.channel;
+        await Promise.all([
+            loadCapabilities({ forceRefresh: true, silent: true }),
+            loadHistory({ forceRefresh: true, silent: true }),
+        ]);
+    } catch (error) {
+        state.auth = null;
+        setStatus(`Token request failed: ${error.message}`, 'danger');
+    } finally {
+        setLoading('token', false);
+        renderAll();
     }
-
-    // Load conversation
-    await loadConversation(sessionId);
-}
-
-// Show sessions list
-function showSessionsList() {
-    document.getElementById('conversationView').classList.add('hidden');
-    document.getElementById('sessionsView').classList.remove('hidden');
-    currentSessionId = null;
 }
 
-// Load conversation
-async function loadConversation(sessionId) {
-    const feed = document.getElementById('conversationFeed');
-    feed.innerHTML = '';
+async function runAnalysis() {
+    const content = dom.contentInput.value.trim();
+    if (!content) {
+        setStatus('Provide suspicious content before analysis.', 'warning');
+        return;
+    }
 
-    // Find the session to get its data
-    const session = [...activeSessions, ...recentSessions].find(s => s.id === sessionId);
+    setLoading('analyze', true);
+    setStatus('Analyzing suspicious signal...');
 
     try {
-        // Try to fetch from API
-        const response = await fetch(`${API_URL}/api/evidence/${sessionId}`, {
-            headers: { 'x-api-key': API_KEY }
+        const response = await requestJson('/api/consumer/analyze', {
+            method: 'POST',
+            body: {
+                channel: state.channel,
+                payload: {
+                    text: content,
+                    senderId: dom.senderInput.value.trim(),
+                    url: dom.urlInput.value.trim(),
+                },
+                metadata: {
+                    platform: state.config.platform,
+                    sourceApp: 'consumer_web_console',
+                    locale: navigator.language || 'en_US',
+                },
+            },
         });
 
-        const evidence = await response.json();
+        state.latestAnalysis = response.data || null;
+        state.cache.history = null;
+        state.cache.detailsBySession.clear();
 
-        // Add AI entry indicator
-        addAIEntryIndicator('AI VARUTRI INITIATED CONVERSATION');
+        setStatus('Analysis complete');
+        updateCacheStatus('history cache invalidated');
+        renderPresence();
+        renderLatestAnalysis();
 
-        // Render conversation
-        if (evidence.conversation && evidence.conversation.length > 0) {
-            evidence.conversation.forEach((turn, index) => {
-                if (index === 0) {
-                    // First message - show when AI entered
-                    addAIEntryIndicator('AI VARUTRI ENTERED CONVERSATION');
-                }
-
-                addMessageToFeed('scammer', turn.userMessage, turn.timestamp);
-                addMessageToFeed('ai', turn.aiResponse, turn.timestamp);
-            });
+        await loadHistory({ forceRefresh: true, silent: true });
+        if (state.latestAnalysis?.sessionId) {
+            await loadHistoryDetail(state.latestAnalysis.sessionId, { forceRefresh: true, silent: true });
         }
+    } catch (error) {
+        setStatus(`Analysis failed: ${error.message}`, 'danger');
+    } finally {
+        setLoading('analyze', false);
+        renderButtons();
+    }
+}
 
-        // Update threat panel
-        updateThreatPanel(evidence);
+async function loadHistory({ forceRefresh = false, silent = false } = {}) {
+    if (!ensureToken(silent)) {
+        return;
+    }
 
-    } catch (error) {
-        console.log('Backend offline, showing demo conversation');
-
-        // Show demo conversation based on session type
-        addAIEntryIndicator('AI VARUTRI INITIATED CONVERSATION');
-
-        if (session && session.scamType === 'LOTTERY_SCAM') {
-            addMessageToFeed('scammer', 'Congratulations! You won 10 lakh rupees in lucky draw!', new Date());
-            addMessageToFeed('ai', 'Arrey beta! Really? How did I win? I did not enter any contest...', new Date());
-            addMessageToFeed('scammer', 'No problem madam! Just send Rs 500 processing fee to 9876543210@paytm', new Date());
-            addMessageToFeed('ai', 'What is this paytm? I am old person, not understanding these things...', new Date());
-            addMessageToFeed('scammer', 'Very simple! Just open Paytm app and send to 9876543210', new Date());
-            addMessageToFeed('ai', 'Okay beta, let me try. But why processing fee for my own prize money?', new Date());
-        } else if (session && session.scamType === 'BANK_SCAM') {
-            addMessageToFeed('scammer', 'Hello, this is from SBI Bank. Your account will be blocked.', new Date());
-            addMessageToFeed('ai', 'What happened? Why blocking my account?', new Date());
-            addMessageToFeed('scammer', 'KYC not updated. Send OTP to verify. Call 9123456789', new Date());
-            addMessageToFeed('ai', 'I am scared! What is OTP? How to send?', new Date());
-        } else if (session && session.scamType === 'JOB_SCAM') {
-            addMessageToFeed('scammer', 'Congratulations! Selected for data entry job. Salary 25000/month', new Date());
-            addMessageToFeed('ai', 'Really? I applied for job? What company?', new Date());
-            addMessageToFeed('scammer', 'Yes! Work from home. Just pay 2000 registration fee to account 1234567890', new Date());
-            addMessageToFeed('ai', 'Why registration fee? Genuine companies dont ask money...', new Date());
-        } else {
-            addMessageToFeed('scammer', 'Hello! You won 10 lakh rupees in lottery!', new Date());
-            addMessageToFeed('ai', 'Arrey beta! Really? How to claim this prize?', new Date());
-            addMessageToFeed('scammer', 'Send Rs 500 to 9876543210@paytm for processing fee', new Date());
-            addMessageToFeed('ai', 'What is this paytm? I am old person, not understanding...', new Date());
+    const now = Date.now();
+    if (!forceRefresh && state.cache.history && state.cache.history.expiresAt > now) {
+        state.history = state.cache.history.value;
+        if (!silent) {
+            setStatus('History loaded from cache');
         }
+        updateCacheStatus('history cache hit');
+        renderHistory();
+        return;
+    }
 
-        // Create demo evidence data
-        const demoEvidence = {
-            threatLevel: session ? session.threatLevel : 0.85,
-            scamType: session ? session.scamType : 'LOTTERY_SCAM',
-            extractedInfo: {
-                upiIds: ['9876543210@paytm'],
-                phoneNumbers: ['9876543210', '9123456789'],
-                bankAccountNumbers: ['1234567890'],
-                suspiciousKeywords: ['won', 'prize', 'lottery', 'processing fee', 'OTP']
-            }
-        };
-
-        // Update threat panel with demo data
-        updateThreatPanel(demoEvidence);
+    setLoading('history', true);
+    if (!silent) {
+        setStatus('Loading timeline...');
     }
-}
 
-// Add AI entry indicator
-function addAIEntryIndicator(text) {
-    const feed = document.getElementById('conversationFeed');
-    const indicator = document.createElement('div');
-    indicator.className = 'ai-entry';
-    indicator.textContent = text;
-    feed.appendChild(indicator);
+    try {
+        const response = await requestJson('/api/consumer/history?limit=20');
+        state.history = Array.isArray(response.data) ? response.data : [];
+        state.cache.history = {
+            value: state.history,
+            expiresAt: now + CACHE_TTL_MS.history,
+        };
+        updateCacheStatus('history refreshed');
+        if (!silent) {
+            setStatus('History loaded');
+        }
+        renderHistory();
+    } catch (error) {
+        if (!silent) {
+            setStatus(`History load failed: ${error.message}`, 'danger');
+        }
+    } finally {
+        setLoading('history', false);
+        renderButtons();
+    }
 }
 
-// Add message to feed
-function addMessageToFeed(type, text, timestamp) {
-    const feed = document.getElementById('conversationFeed');
-    const msgDiv = document.createElement('div');
-    msgDiv.className = `${type}-msg`;
+async function loadHistoryDetail(sessionId, { forceRefresh = false, silent = false } = {}) {
+    if (!ensureToken(silent)) {
+        return;
+    }
 
-    const time = timestamp ? new Date(timestamp).toLocaleTimeString('en-US', { hour12: false }) :
-        new Date().toLocaleTimeString('en-US', { hour12: false });
+    const key = String(sessionId || '').trim();
+    if (!key) {
+        return;
+    }
 
-    const sender = type === 'scammer' ? 'SCAMMER' : type === 'ai' ? 'VARUTRI' : 'SYSTEM';
+    const now = Date.now();
+    const cached = state.cache.detailsBySession.get(key);
+    if (!forceRefresh && cached && cached.expiresAt > now) {
+        state.selectedDetail = cached.value;
+        updateCacheStatus('detail cache hit');
+        renderDetail();
+        if (!silent) {
+            setStatus(`Loaded detail for ${key}`);
+        }
+        return;
+    }
 
-    msgDiv.innerHTML = `
-        <span class="msg-timestamp">[${time}]</span>
-        <span class="msg-sender">${sender}:</span>
-        <span class="msg-content">${text}</span>
-    `;
+    setLoading('detail', true);
+    if (!silent) {
+        setStatus('Loading session detail...');
+    }
 
-    feed.appendChild(msgDiv);
-    feed.scrollTop = feed.scrollHeight;
+    try {
+        const response = await requestJson(`/api/consumer/history/${encodeURIComponent(key)}`);
+        state.selectedDetail = response.data || null;
+        state.cache.detailsBySession.set(key, {
+            value: state.selectedDetail,
+            expiresAt: now + CACHE_TTL_MS.detail,
+        });
+        updateCacheStatus('detail refreshed');
+        if (!silent) {
+            setStatus(`Session detail ready for ${key}`);
+        }
+        renderDetail();
+    } catch (error) {
+        if (!silent) {
+            setStatus(`Detail load failed: ${error.message}`, 'danger');
+        }
+    } finally {
+        setLoading('detail', false);
+        renderButtons();
+    }
 }
 
-// Update session stats
-function updateSessionStats() {
-    const scammerMsgs = document.querySelectorAll('.scammer-msg').length;
-    const aiMsgs = document.querySelectorAll('.ai-msg').length;
+async function loadCapabilities({ forceRefresh = false, silent = false } = {}) {
+    if (!ensureToken(silent)) {
+        return;
+    }
 
-    document.getElementById('totalMessages').textContent = scammerMsgs + aiMsgs;
-    document.getElementById('aiResponses').textContent = aiMsgs;
-    document.getElementById('scammerMessages').textContent = scammerMsgs;
-}
+    const platformKey = state.config.platform.toUpperCase();
+    const now = Date.now();
+    const cached = state.cache.capabilitiesByPlatform.get(platformKey);
+    if (!forceRefresh && cached && cached.expiresAt > now) {
+        state.capabilities = cached.value;
+        updateCacheStatus('capability cache hit');
+        renderCapabilities();
+        if (!silent) {
+            setStatus(`Capabilities loaded from cache for ${platformKey}`);
+        }
+        return;
+    }
 
-// Load conversation data and update panel
-async function loadConversationData() {
-    if (!currentSessionId) return;
+    setLoading('capabilities', true);
+    if (!silent) {
+        setStatus('Loading capability matrix...');
+    }
 
     try {
-        const response = await fetch(`${API_URL}/api/evidence/${currentSessionId}`, {
-            headers: { 'x-api-key': API_KEY }
+        const response = await requestJson(
+            `/api/consumer/capabilities?platform=${encodeURIComponent(platformKey)}`
+        );
+        state.capabilities = response.data || null;
+        state.cache.capabilitiesByPlatform.set(platformKey, {
+            value: state.capabilities,
+            expiresAt: now + CACHE_TTL_MS.capabilities,
         });
-
-        const evidence = await response.json();
-        updateThreatPanel(evidence);
-
+        updateCacheStatus('capabilities refreshed');
+        if (!silent) {
+            setStatus(`Capabilities loaded for ${platformKey}`);
+        }
+        renderCapabilities();
     } catch (error) {
-        console.error('Error loading conversation data:', error);
+        if (!silent) {
+            setStatus(`Capabilities load failed: ${error.message}`, 'danger');
+        }
+    } finally {
+        setLoading('capabilities', false);
+        renderButtons();
     }
 }
 
-// Update threat panel
-function updateThreatPanel(evidence) {
-    // Update threat level
-    const threatLevel = evidence.threatLevel || 0;
-    const threatPercent = Math.round(threatLevel * 100);
-
-    const fillEl = document.getElementById('threatFill');
-    fillEl.style.width = `${threatPercent}%`;
-
-    // Set color class based on level
-    fillEl.className = 'threat-fill';
-    if (threatLevel < 0.4) {
-        fillEl.classList.add('low');
-    } else if (threatLevel < 0.7) {
-        fillEl.classList.add('medium');
-    } else {
-        fillEl.classList.add('high');
+function ensureToken(silent) {
+    if (!state.auth?.accessToken) {
+        if (!silent) {
+            setStatus('Issue a token first.', 'warning');
+        }
+        return false;
     }
 
-    document.getElementById('threatPercent').textContent = `${threatPercent}%`;
+    if (state.auth.expiresAtEpochMs && Date.now() >= state.auth.expiresAtEpochMs) {
+        if (!silent) {
+            setStatus('Token expired. Re-issue token.', 'warning');
+        }
+        return false;
+    }
 
-    // Update threat classification
-    const classEl = document.getElementById('threatClass');
-    classEl.className = 'threat-classification';
+    return true;
+}
 
-    if (threatLevel < 0.4) {
-        classEl.textContent = 'SAFE';
-        classEl.classList.add('safe');
-    } else if (threatLevel < 0.7) {
-        classEl.textContent = 'MEDIUM THREAT';
-    } else {
-        classEl.textContent = 'HIGH THREAT';
-        classEl.classList.add('high');
+async function requestJson(path, { method = 'GET', body = null, auth = true } = {}) {
+    if (auth && !ensureToken(false)) {
+        throw new Error('Missing or expired token');
     }
 
-    // Update scam type
-    document.getElementById('scamType').textContent = evidence.scamType || 'UNKNOWN';
-    document.getElementById('confidence').textContent = threatPercent + '%';
+    const url = `${state.config.baseUrl}${path}`;
+    const headers = {
+        'Content-Type': 'application/json',
+    };
 
-    // Update intelligence
-    const intel = evidence.extractedInfo || {};
-    const intelContainer = document.getElementById('intelContainer');
-    intelContainer.innerHTML = '';
+    if (auth) {
+        headers.Authorization = `Bearer ${state.auth.accessToken}`;
+    }
 
-    let count = 0;
+    const response = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined,
+    });
 
-    if (intel.upiIds && intel.upiIds.length > 0) {
-        intel.upiIds.forEach(upi => {
-            addIntelItem('[CRITICAL] UPI ID: ' + upi, 'critical');
-            count++;
-        });
-    }
+    const text = await response.text();
+    let payload = {};
 
-    if (intel.bankAccountNumbers && intel.bankAccountNumbers.length > 0) {
-        intel.bankAccountNumbers.forEach(acc => {
-            addIntelItem('[CRITICAL] BANK ACC: ' + acc, 'critical');
-            count++;
-        });
+    if (text) {
+        try {
+            payload = JSON.parse(text);
+        } catch (error) {
+            throw new Error(`Non-JSON response from server (${response.status})`);
+        }
     }
 
-    if (intel.phoneNumbers && intel.phoneNumbers.length > 0) {
-        intel.phoneNumbers.forEach(phone => {
-            addIntelItem('[INFO] PHONE: ' + phone, 'info');
-            count++;
-        });
+    if (!response.ok) {
+        const message = payload.message || payload.error || `HTTP ${response.status}`;
+        throw new Error(message);
     }
 
-    if (intel.urls && intel.urls.length > 0) {
-        intel.urls.forEach(url => {
-            addIntelItem('[INFO] URL: ' + url, 'info');
-            count++;
-        });
-    }
+    return payload;
+}
 
-    if (intel.suspiciousKeywords && intel.suspiciousKeywords.length > 0) {
-        const keywords = intel.suspiciousKeywords.slice(0, 5).join(', ');
-        addIntelItem('[WARN] KEYWORDS: ' + keywords, 'warning');
-    }
+function setLoading(key, value) {
+    state.loading[key] = value;
+    renderButtons();
+}
 
-    if (count === 0) {
-        intelContainer.innerHTML = '<div class="intel-empty">No intelligence gathered</div>';
+function setStatus(message, level = 'info') {
+    state.status = message;
+    state.statusLevel = level;
+    dom.statusText.textContent = message;
+    dom.statusText.style.color = statusColor(level);
+}
+
+function statusColor(level) {
+    if (level === 'danger') {
+        return '#b42318';
+    }
+    if (level === 'warning') {
+        return '#b45309';
     }
+    return '#0f766e';
+}
 
-    // Update stats
-    updateSessionStats();
+function updateCacheStatus(message) {
+    dom.cacheStatus.textContent = `Cache: ${message}`;
 }
 
-// Add intelligence item
-function addIntelItem(text, type) {
-    const container = document.getElementById('intelContainer');
-    const item = document.createElement('div');
-    item.className = `intel-item ${type}`;
-    item.textContent = text;
-    container.appendChild(item);
+function tickClock() {
+    const now = new Date();
+    dom.clockChip.textContent = now.toLocaleTimeString('en-GB', { hour12: false });
 }
 
-// Load global stats
-async function loadStats() {
-    try {
-        const response = await fetch(`${API_URL}/api/report/stats`, {
-            headers: { 'x-api-key': API_KEY }
-        });
+function renderAll() {
+    renderButtons();
+    renderStatusChips();
+    renderPresence();
+    renderLatestAnalysis();
+    renderHistory();
+    renderCapabilities();
+    renderDetail();
+}
+
+function renderButtons() {
+    dom.issueTokenBtn.disabled = state.loading.token;
+    dom.loadCapabilitiesBtn.disabled = state.loading.capabilities || state.loading.token;
+    dom.analyzeBtn.disabled = state.loading.analyze;
+    dom.refreshHistoryBtn.disabled = state.loading.history;
+}
 
-        const stats = await response.json();
-        document.getElementById('totalReports').textContent = stats.totalReports || 0;
+function renderStatusChips() {
+    const tokenPreview = state.auth?.accessToken
+        ? `${state.auth.accessToken.slice(0, 8)}...${state.auth.accessToken.slice(-4)}`
+        : 'Not issued';
 
-    } catch (error) {
-        console.error('Error loading stats:', error);
-        document.getElementById('totalReports').textContent = '0';
-    }
+    dom.tokenChip.textContent = `Token: ${tokenPreview}`;
+    dom.tokenExpiryText.textContent = state.auth?.expiresAtEpochMs
+        ? new Date(state.auth.expiresAtEpochMs).toISOString()
+        : 'No token';
 }
 
-// Run tests
-async function runTests() {
-    if (!confirm('Run diagnostic scenarios? This will test the AI honeypot system.')) {
-        return;
+function renderPresence() {
+    const presence = derivePresence(state.latestAnalysis);
+    dom.presenceChip.textContent = `Presence: ${presence.label}`;
+    dom.presencePanel.classList.remove('presence-idle', 'presence-safe', 'presence-watch', 'presence-danger');
+    dom.presencePanel.classList.add(presence.className);
+    dom.presenceTitle.textContent = presence.title;
+    dom.presenceNote.textContent = presence.note;
+
+    if (state.latestAnalysis) {
+        dom.latestAnalysisSummary.textContent = `${state.latestAnalysis.channel} ${state.latestAnalysis.verdict} | ${state.latestAnalysis.threatLevel} ${Number(state.latestAnalysis.threatScore || 0).toFixed(2)}`;
+    } else {
+        dom.latestAnalysisSummary.textContent = 'No analysis yet.';
     }
+}
 
-    try {
-        const response = await fetch(`${API_URL}/api/test/run-all`, {
-            method: 'POST',
-            headers: { 'x-api-key': API_KEY }
-        });
+function derivePresence(analysis) {
+    if (!analysis) {
+        return {
+            label: 'IDLE',
+            className: 'presence-idle',
+            title: 'Idle Monitoring',
+            note: 'Awaiting first signal. Ingest suspicious content to activate risk posture.',
+        };
+    }
 
-        const results = await response.json();
+    const level = String(analysis.threatLevel || '').toUpperCase();
+    if (level === 'CRITICAL' || level === 'HIGH') {
+        return {
+            label: 'DANGER',
+            className: 'presence-danger',
+            title: 'High-Risk Defense Active',
+            note: 'Prioritize evidence preservation and immediate user escalation steps.',
+        };
+    }
+    if (level === 'MEDIUM' || level === 'LOW') {
+        return {
+            label: 'WATCH',
+            className: 'presence-watch',
+            title: 'Watch Mode',
+            note: 'Suspicious indicators present. Verify each requested action through official channels.',
+        };
+    }
 
-        let message = 'DIAGNOSTIC RESULTS:\n\n';
-        results.forEach(result => {
-            const status = result.passed ? '[PASS]' : '[FAIL]';
-            message += `${status}: ${result.scenarioName}\n`;
-        });
+    return {
+        label: 'SAFE',
+        className: 'presence-safe',
+        title: 'Stable',
+        note: 'No high-severity signal in latest analysis. Continue caution baseline.',
+    };
+}
 
-        const passed = results.filter(r => r.passed).length;
-        message += `\nTotal: ${passed}/${results.length} passed`;
+function renderLatestAnalysis() {
+    const analysis = state.latestAnalysis;
+    if (!analysis) {
+        dom.analysisContent.innerHTML = '<div class="empty-state">No analysis data yet.</div>';
+        return;
+    }
 
-        alert(message);
+    const actions = listHtml(analysis.recommendedActions || []);
+    const notes = listHtml(analysis.platformNotes || []);
+
+    dom.analysisContent.innerHTML = `
+        <div class="detail-card">
+            <h4>Session ${escapeHtml(analysis.sessionId || '-')}</h4>
+            <ul class="mini-list">
+                <li>Verdict: <strong>${escapeHtml(analysis.verdict || 'UNKNOWN')}</strong></li>
+                <li>Threat: <strong>${escapeHtml(analysis.threatLevel || 'UNKNOWN')}</strong> (${Number(analysis.threatScore || 0).toFixed(2)})</li>
+                <li>Channel: <strong>${escapeHtml(analysis.channel || '-')}</strong></li>
+            </ul>
+        </div>
+        <div class="detail-card">
+            <h4>Recommended Actions</h4>
+            ${actions}
+        </div>
+        <div class="detail-card">
+            <h4>Platform Notes</h4>
+            ${notes}
+        </div>
+    `;
+}
 
-    } catch (error) {
-        alert(`[ERROR] Diagnostic failed: ${error.message}`);
+function renderHistory() {
+    if (!Array.isArray(state.history) || state.history.length === 0) {
+        dom.historyList.innerHTML = '<div class="empty-state">No sessions loaded yet.</div>';
+        return;
     }
+
+    dom.historyList.innerHTML = state.history.map((item) => {
+        const tone = toneFromThreat(item.threatLevel, item.verdict);
+        return `
+            <article class="history-item" data-session-id="${escapeHtml(item.sessionId || '')}">
+                <div class="history-head">
+                    <strong>${escapeHtml(item.channel || 'UNKNOWN')} | ${escapeHtml(item.verdict || 'UNKNOWN')}</strong>
+                    <span class="badge ${tone}">${escapeHtml(item.threatLevel || 'UNKNOWN')}</span>
+                </div>
+                <ul class="history-meta">
+                    <li class="mono">${escapeHtml(item.sessionId || '-')}</li>
+                    <li>Score: ${Number(item.threatScore || 0).toFixed(2)}</li>
+                    <li>Updated: ${escapeHtml(item.lastUpdated || '-')}</li>
+                </ul>
+            </article>
+        `;
+    }).join('');
 }
 
-// Generate report
-async function generateReport() {
-    if (!currentSessionId) {
-        alert('Please select a session first');
+function renderCapabilities() {
+    const capabilities = state.capabilities;
+    if (!capabilities) {
+        dom.capabilitiesSummary.textContent = 'No capability data yet.';
+        dom.capabilitiesList.innerHTML = '<div class="empty-state">Issue token and load capabilities for the active platform.</div>';
         return;
     }
 
-    if (!confirm('Generate classified report for this session?')) {
+    dom.capabilitiesSummary.textContent = `${capabilities.platform || state.config.platform} | Generated: ${capabilities.generatedAt || '-'}`;
+
+    const channelCards = (capabilities.channels || []).map((channel) => `
+        <article class="capability-item">
+            <h4>${escapeHtml(channel.channel || 'UNKNOWN')} (${escapeHtml(channel.automationLevel || 'UNKNOWN')})</h4>
+            <ul class="mini-list">
+                <li>Passive Detection: ${channel.passiveDetection ? 'Yes' : 'No'}</li>
+                <li>User Share Required: ${channel.userShareRequired ? 'Yes' : 'No'}</li>
+            </ul>
+            <p class="mono">Limitations</p>
+            ${listHtml(channel.limitations || [])}
+            <p class="mono">Recommended Flows</p>
+            ${listHtml(channel.recommendedFlows || [])}
+        </article>
+    `).join('');
+
+    const globalBlock = `
+        <article class="capability-item">
+            <h4>Global Limitations</h4>
+            ${listHtml(capabilities.globalLimitations || [])}
+        </article>
+        <article class="capability-item">
+            <h4>Operational Notes</h4>
+            ${listHtml(capabilities.operationalNotes || [])}
+        </article>
+    `;
+
+    dom.capabilitiesList.innerHTML = `${channelCards}${globalBlock}`;
+}
+
+function renderDetail() {
+    const detail = state.selectedDetail;
+    if (!detail) {
+        dom.detailContainer.innerHTML = '<div class="empty-state">Select a timeline session to inspect detail.</div>';
         return;
     }
 
-    try {
-        const response = await fetch(`${API_URL}/api/report/manual`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'x-api-key': API_KEY
-            },
-            body: JSON.stringify({ sessionId: currentSessionId })
-        });
+    const conversation = listHtml((detail.conversation || []).map((entry) => {
+        return `${entry.sender || 'unknown'} @ ${entry.timestamp || '-'}: ${entry.text || ''}`;
+    }));
+
+    const indicators = flattenIndicators(detail.extractedInfo || {});
+
+    dom.detailContainer.innerHTML = `
+        <article class="detail-card">
+            <h4>${escapeHtml(detail.sessionId || '-')}</h4>
+            <ul class="mini-list">
+                <li>Channel: ${escapeHtml(detail.channel || 'UNKNOWN')}</li>
+                <li>Verdict: ${escapeHtml(detail.verdict || 'UNKNOWN')}</li>
+                <li>Threat: ${escapeHtml(detail.threatLevel || 'UNKNOWN')} (${Number(detail.threatScore || 0).toFixed(2)})</li>
+            </ul>
+        </article>
+        <article class="detail-card">
+            <h4>Conversation</h4>
+            <div class="conversation-list-wrap">${conversation}</div>
+        </article>
+        <article class="detail-card">
+            <h4>Extracted Indicators</h4>
+            <div class="indicator-list-wrap">${listHtml(indicators)}</div>
+        </article>
+    `;
+}
 
-        const result = await response.json();
+function toneFromThreat(threatLevel, verdict) {
+    const level = String(threatLevel || '').toUpperCase();
+    const verdictLabel = String(verdict || '').toUpperCase();
 
-        if (result.status === 'success') {
-            alert(`[SUCCESS] Report ${result.reportId} generated\n\nThreat: ${(result.threatLevel * 100).toFixed(0)}%\nIntelligence: ${result.intelligenceCount} items`);
-            loadStats();
-        } else {
-            alert(`[ERROR] Report generation failed: ${result.message}`);
-        }
+    if (level === 'HIGH' || level === 'CRITICAL' || verdictLabel === 'DANGER') {
+        return 'danger';
+    }
+    if (level === 'MEDIUM' || level === 'LOW' || verdictLabel === 'SUSPICIOUS') {
+        return 'watch';
+    }
+    return 'safe';
+}
 
-    } catch (error) {
-        alert(`[ERROR] Report generation failed: ${error.message}`);
+function flattenIndicators(extracted) {
+    const entries = [];
+    const map = {
+        upiIds: 'UPI',
+        bankAccountNumbers: 'Bank Account',
+        ifscCodes: 'IFSC',
+        phoneNumbers: 'Phone',
+        urls: 'URL',
+        emails: 'Email',
+        suspiciousKeywords: 'Keyword',
+    };
+
+    Object.entries(map).forEach(([key, label]) => {
+        const values = Array.isArray(extracted[key]) ? extracted[key] : [];
+        values.forEach((value) => entries.push(`${label}: ${value}`));
+    });
+
+    return entries;
+}
+
+function listHtml(values) {
+    if (!values || values.length === 0) {
+        return '<div class="empty-state">None</div>';
     }
+
+    return `<ul class="mini-list">${values
+        .map((value) => `<li>${escapeHtml(String(value))}</li>`)
+        .join('')}</ul>`;
+}
+
+function escapeHtml(value) {
+    return String(value)
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
 }
diff --git a/frontend/index.html b/frontend/index.html
index 8c6c36c..2f5a001 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -4,149 +4,156 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>VARUTRI CONTROL INTERFACE</title>
+    <title>Varutri Consumer Command Center</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap"
+        rel="stylesheet">
     <link rel="stylesheet" href="style.css">
 </head>
 
 <body>
-    <div class="control-interface">
-        <!-- Top Header -->
-        <header class="top-header">
-            <div class="header-left">
-                <span class="logo">VARUTRI HONEYPOT SYSTEM</span>
+    <div class="ambient-layer"></div>
+    <div class="grain-layer"></div>
+
+    <div class="app-shell">
+        <header class="top-rail panel reveal-up">
+            <div>
+                <p class="eyebrow">Varutri Consumer Protection</p>
+                <h1>Scam Signal Operations Console</h1>
+                <p class="subtitle">End-to-end command surface for token auth, analysis, timeline review, and platform capabilities.</p>
             </div>
-            <div class="header-right">
-                <span class="timestamp" id="timestamp"></span>
+            <div class="status-cluster">
+                <div class="status-chip" id="presenceChip">Presence: IDLE</div>
+                <div class="status-chip subtle" id="tokenChip">Token: Not issued</div>
+                <div class="status-chip subtle mono" id="clockChip">--:--:--</div>
             </div>
         </header>
 
-        <!-- Main Content -->
-        <div class="main-content">
-            <!-- Sessions List View (Default) -->
-            <div class="sessions-view" id="sessionsView">
-                <!-- Active Sessions -->
-                <div class="sessions-section">
-                    <div class="section-header">
-                        <span>ACTIVE SESSIONS</span>
-                        <span class="session-count" id="activeCount">0</span>
-                    </div>
-                    <div class="sessions-list" id="activeSessions">
-                        <div class="empty-state">No active sessions</div>
-                    </div>
-                </div>
-
-                <!-- Recent Sessions -->
-                <div class="sessions-section">
-                    <div class="section-header">
-                        <span>RECENT SESSIONS</span>
-                        <span class="session-count" id="recentCount">0</span>
-                    </div>
-                    <div class="sessions-list" id="recentSessions">
-                        <div class="empty-state">No recent sessions</div>
-                    </div>
+        <main class="dashboard-grid">
+            <section class="panel connection-panel reveal-up delay-1">
+                <div class="section-head">
+                    <h2>1. Server Boundary</h2>
+                    <p>Connection and token lifecycle</p>
                 </div>
-            </div>
-
-            <!-- Conversation View (Hidden by default) -->
-            <div class="conversation-view hidden" id="conversationView">
-                <!-- Left Panel: Conversation -->
-                <div class="left-panel">
-                    <div class="panel-header">
-                        <button class="back-btn" onclick="showSessionsList()">← BACK TO SESSIONS</button>
-                        <div class="session-meta">
-                            <span id="currentSessionId">SESSION-001</span>
-                            <span class="separator">|</span>
-                            <span id="currentChannel">WHATSAPP</span>
-                        </div>
+                <form id="connectionForm" class="form-grid">
+                    <label>
+                        Base URL
+                        <input id="baseUrlInput" type="url" required>
+                    </label>
+                    <label>
+                        App ID
+                        <input id="appIdInput" type="text" required>
+                    </label>
+                    <label>
+                        Device ID
+                        <input id="deviceIdInput" type="text" required>
+                    </label>
+                    <label>
+                        App Version
+                        <input id="appVersionInput" type="text" required>
+                    </label>
+                    <label>
+                        Platform
+                        <select id="platformSelect">
+                            <option value="ANDROID">ANDROID</option>
+                            <option value="IOS">IOS</option>
+                            <option value="WEB">WEB</option>
+                            <option value="EXTENSION">EXTENSION</option>
+                        </select>
+                    </label>
+                    <div class="button-row">
+                        <button type="submit" class="btn primary" id="issueTokenBtn">Issue Token</button>
+                        <button type="button" class="btn soft" id="loadCapabilitiesBtn">Load Capabilities</button>
                     </div>
+                </form>
+                <p class="meta-line">Token Expiry: <span id="tokenExpiryText">No token</span></p>
+            </section>
 
-                    <!-- Conversation Feed -->
-                    <div class="conversation-feed" id="conversationFeed">
-                        <div class="system-msg">
-                            <span class="msg-timestamp">[SYSTEM]</span>
-                            <span class="msg-content">Select a session to view conversation</span>
-                        </div>
-                    </div>
+            <section class="panel presence-panel reveal-up delay-2" id="presencePanel">
+                <div class="section-head">
+                    <h2>2. On-Screen Presence</h2>
+                    <p>Dynamic threat posture</p>
                 </div>
+                <p class="presence-title" id="presenceTitle">Idle Monitoring</p>
+                <p class="presence-note" id="presenceNote">Issue a token and run analysis to activate real-time posture guidance.</p>
+                <div class="latest-analysis" id="latestAnalysisSummary">No analysis yet.</div>
+            </section>
 
-                <!-- Right Panel: Intelligence -->
-                <div class="right-panel">
-                    <!-- AI Intervention Stats -->
-                    <div class="stats-section">
-                        <div class="section-header">AI INTERVENTION</div>
-                        <div class="stats-grid">
-                            <div class="stat-item">
-                                <div class="stat-label">TOTAL MESSAGES</div>
-                                <div class="stat-value" id="totalMessages">0</div>
-                            </div>
-                            <div class="stat-item">
-                                <div class="stat-label">AI RESPONSES</div>
-                                <div class="stat-value" id="aiResponses">0</div>
-                            </div>
-                            <div class="stat-item">
-                                <div class="stat-label">SCAMMER MSGS</div>
-                                <div class="stat-value" id="scammerMessages">0</div>
-                            </div>
-                            <div class="stat-item">
-                                <div class="stat-label">DURATION</div>
-                                <div class="stat-value" id="sessionDuration">0m</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Threat Assessment -->
-                    <div class="threat-section">
-                        <div class="section-header">THREAT LEVEL</div>
-                        <div class="threat-display">
-                            <div class="threat-meter">
-                                <div class="threat-fill" id="threatFill"></div>
-                                <div class="threat-percentage" id="threatPercent">0%</div>
-                            </div>
-                            <div class="threat-classification" id="threatClass">SAFE</div>
-                        </div>
+            <section class="panel analyze-panel reveal-up delay-3">
+                <div class="section-head">
+                    <h2>3. Analyze Signal</h2>
+                    <p>Capture suspicious content</p>
+                </div>
+                <form id="analyzeForm" class="form-grid">
+                    <label>
+                        Channel
+                        <select id="channelSelect">
+                            <option value="SMS">SMS</option>
+                            <option value="CALL">CALL</option>
+                            <option value="WHATSAPP">WHATSAPP</option>
+                            <option value="EMAIL">EMAIL</option>
+                            <option value="BROWSER">BROWSER</option>
+                            <option value="MANUAL">MANUAL</option>
+                            <option value="PROMPT">PROMPT</option>
+                        </select>
+                    </label>
+                    <label>
+                        Suspicious Content
+                        <textarea id="contentInput" rows="5" placeholder="Paste suspicious message, call transcript, email snippet, URL context, or prompt text."></textarea>
+                    </label>
+                    <label>
+                        Sender ID (optional)
+                        <input id="senderInput" type="text" placeholder="+9198xxxxxx / email / username">
+                    </label>
+                    <label>
+                        URL (optional)
+                        <input id="urlInput" type="url" placeholder="https://example-link">
+                    </label>
+                    <div class="button-row">
+                        <button type="submit" class="btn primary" id="analyzeBtn">Run Threat Analysis</button>
+                        <button type="button" class="btn soft" id="refreshHistoryBtn">Refresh Timeline</button>
                     </div>
+                </form>
+                <div class="analysis-block" id="analysisBlock">
+                    <h3>Latest Analysis</h3>
+                    <div id="analysisContent">No analysis data yet.</div>
+                </div>
+            </section>
 
-                    <!-- Scam Classification -->
-                    <div class="data-section">
-                        <div class="section-header">CLASSIFICATION</div>
-                        <div class="data-table">
-                            <div class="data-row">
-                                <span class="data-label">TYPE:</span>
-                                <span class="data-value" id="scamType">UNKNOWN</span>
-                            </div>
-                            <div class="data-row">
-                                <span class="data-label">CONFIDENCE:</span>
-                                <span class="data-value" id="confidence">N/A</span>
-                            </div>
-                        </div>
-                    </div>
+            <section class="panel history-panel reveal-up delay-4">
+                <div class="section-head">
+                    <h2>4. Evidence Timeline</h2>
+                    <p>Recent sessions and drill-down</p>
+                </div>
+                <div class="history-list" id="historyList">
+                    <div class="empty-state">No sessions loaded yet.</div>
+                </div>
+            </section>
 
-                    <!-- Intelligence Extracted -->
-                    <div class="intel-section">
-                        <div class="section-header">INTELLIGENCE EXTRACTED</div>
-                        <div class="intel-container" id="intelContainer">
-                            <div class="intel-empty">No intelligence gathered</div>
-                        </div>
-                    </div>
+            <section class="panel capabilities-panel reveal-up delay-5">
+                <div class="section-head">
+                    <h2>5. Capability Matrix</h2>
+                    <p>Automation boundaries by platform</p>
+                </div>
+                <div id="capabilitiesSummary" class="capability-summary">No capability data yet.</div>
+                <div class="capability-list" id="capabilitiesList"></div>
+            </section>
 
-                    <!-- Actions -->
-                    <div class="actions-section">
-                        <button class="action-btn" onclick="generateReport()">GENERATE REPORT</button>
-                        <button class="action-btn" onclick="runTests()">RUN DIAGNOSTICS</button>
-                    </div>
+            <section class="panel detail-panel reveal-up delay-6">
+                <div class="section-head">
+                    <h2>6. Session Detail</h2>
+                    <p>Conversation and indicators</p>
                 </div>
-            </div>
-        </div>
+                <div id="detailContainer" class="detail-content">
+                    <div class="empty-state">Select a timeline session to inspect detail.</div>
+                </div>
+            </section>
+        </main>
 
-        <!-- Bottom Status Bar -->
-        <footer class="status-bar">
-            <div class="status-left">
-                <span class="status-item">SYSTEM: <span class="status-online">ONLINE</span></span>
-                <span class="status-item">ENCRYPTION: <span class="status-online">ACTIVE</span></span>
-            </div>
-            <div class="status-right">
-                <span class="status-item">REPORTS GENERATED: <span id="totalReports">0</span></span>
-            </div>
+        <footer class="bottom-rail panel reveal-up delay-6">
+            <span class="mono">Status: <strong id="statusText">Ready</strong></span>
+            <span class="mono" id="cacheStatus">Cache: idle</span>
         </footer>
     </div>
 
diff --git a/frontend/style.css b/frontend/style.css
index 1ba6def..2b820a5 100644
--- a/frontend/style.css
+++ b/frontend/style.css
@@ -1,715 +1,500 @@
+:root {
+    --bg-paper: #f7f4ed;
+    --bg-highlight: #ffe6c8;
+    --ink: #12231d;
+    --muted: #4f6258;
+    --line: #d7d4c7;
+    --panel: rgba(255, 255, 255, 0.78);
+    --primary: #0f766e;
+    --primary-strong: #0a4f49;
+    --warning: #b45309;
+    --danger: #b42318;
+    --safe: #1f7a43;
+    --radius: 16px;
+    --shadow-soft: 0 18px 32px rgba(31, 28, 17, 0.08);
+}
+
 * {
-    margin: 0;
-    padding: 0;
     box-sizing: border-box;
 }
 
+html,
 body {
-    font-family: 'Consolas', 'Monaco', 'Courier New', monospace;
-    background: #0a0a0a;
-    color: #e0e0e0;
-    overflow: hidden;
-}
-
-.control-interface {
-    height: 100vh;
-    display: flex;
-    flex-direction: column;
-    background: #0a0a0a;
-}
-
-/* Top Header */
-.top-header {
-    background: #1a1a1a;
-    border-bottom: 1px solid #333;
-    padding: 16px 24px;
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-}
-
-.logo {
-    font-size: 18px;
-    font-weight: bold;
-    color: #fff;
-    letter-spacing: 1.5px;
-}
-
-.header-right {
-    font-size: 12px;
-    color: #888;
+    margin: 0;
+    min-height: 100%;
 }
 
-/* Main Content */
-.main-content {
-    flex: 1;
-    overflow: hidden;
+body {
+    font-family: 'Space Grotesk', 'Trebuchet MS', sans-serif;
+    color: var(--ink);
+    background: linear-gradient(132deg, var(--bg-paper) 0%, #fffdf7 48%, #f4f8f2 100%);
     position: relative;
+    padding: 20px;
 }
 
-/* Sessions View */
-.sessions-view {
-    height: 100%;
-    overflow-y: auto;
-    padding: 24px;
+.ambient-layer,
+.grain-layer {
+    position: fixed;
+    inset: 0;
+    pointer-events: none;
 }
 
-.sessions-view::-webkit-scrollbar {
-    width: 8px;
+.ambient-layer {
+    background:
+        radial-gradient(36rem 24rem at 94% 3%, rgba(15, 118, 110, 0.22), transparent 70%),
+        radial-gradient(30rem 20rem at 4% 92%, rgba(253, 186, 116, 0.26), transparent 72%),
+        radial-gradient(32rem 24rem at 50% 58%, rgba(34, 197, 94, 0.1), transparent 70%);
 }
 
-.sessions-view::-webkit-scrollbar-track {
-    background: #0a0a0a;
+.grain-layer {
+    background-image: linear-gradient(transparent 95%, rgba(10, 10, 10, 0.05) 100%);
+    background-size: 100% 3px;
+    opacity: 0.22;
 }
 
-.sessions-view::-webkit-scrollbar-thumb {
-    background: #333;
-    border-radius: 4px;
+.app-shell {
+    max-width: 1420px;
+    margin: 0 auto;
+    position: relative;
+    z-index: 1;
 }
 
-.sessions-section {
-    margin-bottom: 32px;
+.panel {
+    background: var(--panel);
+    border: 1px solid rgba(255, 255, 255, 0.45);
+    border-radius: var(--radius);
+    box-shadow: var(--shadow-soft);
+    backdrop-filter: blur(9px);
 }
 
-.section-header {
+.top-rail {
+    padding: 18px 22px;
     display: flex;
+    align-items: flex-start;
     justify-content: space-between;
-    align-items: center;
-    padding: 12px 16px;
-    background: #1a1a1a;
-    border-left: 3px solid #4ade80;
-    margin-bottom: 12px;
-    font-size: 13px;
-    font-weight: bold;
-    letter-spacing: 1px;
+    gap: 14px;
+    margin-bottom: 18px;
 }
 
-.session-count {
-    background: #4ade80;
-    color: #0a0a0a;
-    padding: 4px 12px;
-    border-radius: 2px;
-    font-size: 12px;
+.eyebrow {
+    text-transform: uppercase;
+    letter-spacing: 0.1em;
+    font-size: 0.72rem;
+    color: var(--muted);
+    margin: 0 0 4px;
 }
 
-.sessions-list {
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(350px, 1fr));
-    gap: 16px;
-}
-
-/* Session Card */
-.session-card {
-    background: #0f0f0f;
-    border: 1px solid #333;
-    padding: 16px;
-    cursor: pointer;
-    transition: all 0.2s;
-}
-
-.session-card:hover {
-    border-color: #4ade80;
-    background: #1a1a1a;
-    box-shadow: 0 0 20px rgba(74, 222, 128, 0.1);
-}
-
-.session-card-header {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    margin-bottom: 12px;
-    padding-bottom: 12px;
-    border-bottom: 1px solid #1a1a1a;
+h1 {
+    margin: 0;
+    font-size: clamp(1.45rem, 2.5vw, 2rem);
+    line-height: 1.1;
 }
 
-.session-id {
-    font-size: 13px;
-    font-weight: bold;
-    color: #fff;
+.subtitle {
+    margin: 8px 0 0;
+    color: var(--muted);
+    max-width: 56ch;
+    font-size: 0.95rem;
 }
 
-.session-channel {
-    font-size: 10px;
-    color: #4ade80;
-    background: rgba(74, 222, 128, 0.1);
-    padding: 4px 8px;
-    border: 1px solid #4ade80;
-    border-radius: 2px;
+.status-cluster {
+    display: grid;
+    gap: 8px;
 }
 
-.session-card-body {
-    margin-bottom: 12px;
+.status-chip {
+    border-radius: 999px;
+    padding: 9px 14px;
+    background: #deeee7;
+    color: var(--primary-strong);
+    font-weight: 700;
+    font-size: 0.78rem;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
 }
 
-.session-info-row {
-    display: flex;
-    justify-content: space-between;
-    margin-bottom: 8px;
-    font-size: 11px;
+.status-chip.subtle {
+    background: #f4efe2;
+    color: #614f2f;
 }
 
-.session-info-label {
-    color: #666;
+.mono {
+    font-family: 'IBM Plex Mono', 'Courier New', monospace;
 }
 
-.session-info-value {
-    color: #e0e0e0;
-    font-weight: bold;
+.dashboard-grid {
+    display: grid;
+    gap: 14px;
+    grid-template-columns: repeat(12, minmax(0, 1fr));
 }
 
-.session-threat {
-    display: flex;
-    align-items: center;
-    gap: 12px;
-    margin-top: 12px;
+.connection-panel {
+    grid-column: span 4;
+    padding: 16px;
 }
 
-.session-threat-bar {
-    flex: 1;
-    height: 6px;
-    background: #1a1a1a;
-    border-radius: 3px;
-    overflow: hidden;
+.presence-panel {
+    grid-column: span 4;
+    padding: 16px;
+    background: linear-gradient(160deg, #f3ece0 0%, #ffffff 75%);
 }
 
-.session-threat-fill {
-    height: 100%;
-    transition: width 0.3s, background-color 0.3s;
+.analyze-panel {
+    grid-column: span 4;
+    padding: 16px;
 }
 
-.session-threat-fill.low {
-    background: #4ade80;
+.history-panel {
+    grid-column: span 5;
+    padding: 16px;
+    min-height: 340px;
 }
 
-.session-threat-fill.medium {
-    background: #fbbf24;
+.capabilities-panel {
+    grid-column: span 4;
+    padding: 16px;
+    min-height: 340px;
 }
 
-.session-threat-fill.high {
-    background: #ff4444;
+.detail-panel {
+    grid-column: span 3;
+    padding: 16px;
+    min-height: 340px;
 }
 
-.session-threat-value {
-    font-size: 11px;
-    font-weight: bold;
-    min-width: 40px;
-    text-align: right;
+.bottom-rail {
+    margin-top: 14px;
+    padding: 10px 16px;
+    display: flex;
+    justify-content: space-between;
+    gap: 10px;
+    font-size: 0.76rem;
 }
 
-.session-threat-value.low {
-    color: #4ade80;
+.section-head {
+    margin-bottom: 10px;
 }
 
-.session-threat-value.medium {
-    color: #fbbf24;
+.section-head h2 {
+    margin: 0;
+    font-size: 1.02rem;
 }
 
-.session-threat-value.high {
-    color: #ff4444;
+.section-head p {
+    margin: 3px 0 0;
+    font-size: 0.83rem;
+    color: var(--muted);
 }
 
-.empty-state {
-    text-align: center;
-    padding: 40px;
-    color: #555;
-    font-size: 13px;
+.form-grid {
+    display: grid;
+    gap: 10px;
 }
 
-/* Conversation View */
-.conversation-view {
-    height: 100%;
-    display: flex;
-    gap: 1px;
-    background: #1a1a1a;
+label {
+    display: grid;
+    gap: 5px;
+    font-size: 0.78rem;
+    color: var(--muted);
 }
 
-.conversation-view.hidden {
-    display: none;
+input,
+textarea,
+select {
+    font: inherit;
+    color: var(--ink);
+    border: 1px solid var(--line);
+    border-radius: 10px;
+    background: rgba(255, 255, 255, 0.86);
+    padding: 9px 10px;
 }
 
-.hidden {
-    display: none !important;
+textarea {
+    resize: vertical;
+    min-height: 120px;
 }
 
-/* Left Panel */
-.left-panel {
-    flex: 1.5;
-    background: #0a0a0a;
-    display: flex;
-    flex-direction: column;
-    border-right: 1px solid #333;
+input:focus,
+textarea:focus,
+select:focus {
+    outline: 2px solid rgba(15, 118, 110, 0.22);
+    border-color: var(--primary);
 }
 
-.panel-header {
-    background: #1a1a1a;
-    padding: 16px 20px;
-    border-bottom: 1px solid #333;
+.button-row {
     display: flex;
-    align-items: center;
-    gap: 20px;
+    gap: 8px;
+    flex-wrap: wrap;
 }
 
-.back-btn {
-    background: transparent;
-    border: 1px solid #4ade80;
-    color: #4ade80;
-    padding: 8px 16px;
-    font-family: 'Consolas', monospace;
-    font-size: 11px;
-    font-weight: bold;
+.btn {
+    font: inherit;
+    border-radius: 10px;
+    border: 1px solid transparent;
+    padding: 9px 13px;
     cursor: pointer;
-    transition: all 0.2s;
-    letter-spacing: 0.5px;
-}
-
-.back-btn:hover {
-    background: rgba(74, 222, 128, 0.1);
-}
-
-.session-meta {
-    display: flex;
-    gap: 12px;
-    font-size: 12px;
-    color: #888;
+    font-weight: 600;
 }
 
-.session-meta #currentSessionId {
-    color: #fff;
-    font-weight: bold;
+.btn.primary {
+    color: #effffb;
+    background: linear-gradient(160deg, var(--primary), var(--primary-strong));
 }
 
-.session-meta #currentChannel {
-    color: #4ade80;
+.btn.soft {
+    color: #21433c;
+    background: #e6f1ee;
+    border-color: #c3d8d2;
 }
 
-.separator {
-    color: #333;
+.btn:disabled {
+    opacity: 0.56;
+    cursor: wait;
 }
 
-/* Conversation Feed */
-.conversation-feed {
-    flex: 1;
-    overflow-y: auto;
-    padding: 20px;
-    display: flex;
-    flex-direction: column;
-    gap: 12px;
-}
-
-.conversation-feed::-webkit-scrollbar {
-    width: 6px;
-}
-
-.conversation-feed::-webkit-scrollbar-track {
-    background: #0a0a0a;
+.meta-line {
+    margin: 10px 0 0;
+    font-size: 0.74rem;
+    color: var(--muted);
 }
 
-.conversation-feed::-webkit-scrollbar-thumb {
-    background: #333;
-    border-radius: 3px;
-}
-
-/* Messages */
-.system-msg,
-.scammer-msg,
-.ai-msg {
-    padding: 12px 16px;
-    border-left: 3px solid;
-    background: #0f0f0f;
-    font-size: 13px;
-    line-height: 1.6;
-}
-
-.system-msg {
-    border-left-color: #666;
-    color: #888;
+.presence-title {
+    margin: 0;
+    font-size: 1.28rem;
+    font-weight: 700;
 }
 
-.scammer-msg {
-    border-left-color: #ff4444;
-    background: rgba(255, 68, 68, 0.05);
+.presence-note {
+    margin: 6px 0 0;
+    color: var(--muted);
+    font-size: 0.9rem;
 }
 
-.ai-msg {
-    border-left-color: #4ade80;
-    background: rgba(74, 222, 128, 0.05);
+.latest-analysis {
+    margin-top: 12px;
+    border-radius: 12px;
+    background: rgba(255, 255, 255, 0.74);
+    border: 1px solid #ece7d9;
+    padding: 10px;
+    font-size: 0.86rem;
 }
 
-.msg-timestamp {
-    color: #555;
-    font-size: 11px;
-    margin-right: 8px;
-    display: inline-block;
-    min-width: 120px;
+.presence-idle {
+    border-color: #d3d0c5;
 }
 
-.msg-sender {
-    color: #888;
-    font-size: 11px;
-    font-weight: bold;
-    margin-right: 8px;
+.presence-safe {
+    border-color: #b8dfc5;
+    box-shadow: 0 0 0 2px rgba(16, 185, 129, 0.15);
 }
 
-.scammer-msg .msg-sender {
-    color: #ff9999;
+.presence-watch {
+    border-color: #f0cc96;
+    box-shadow: 0 0 0 2px rgba(245, 158, 11, 0.16);
 }
 
-.ai-msg .msg-sender {
-    color: #a3e6b8;
+.presence-danger {
+    border-color: #f1a9a0;
+    box-shadow: 0 0 0 2px rgba(220, 38, 38, 0.2);
+    animation: dangerPulse 2.1s infinite;
 }
 
-.msg-content {
-    color: #e0e0e0;
-}
+@keyframes dangerPulse {
+    0% {
+        transform: translateZ(0);
+    }
 
-/* AI Entry Indicator */
-.ai-entry {
-    padding: 10px 16px;
-    background: rgba(74, 222, 128, 0.1);
-    border-left: 3px solid #4ade80;
-    text-align: center;
-    font-size: 11px;
-    color: #4ade80;
-    font-weight: bold;
-    letter-spacing: 0.5px;
-}
+    50% {
+        transform: translateY(-1px);
+    }
 
-/* Input Container */
-.input-container {
-    border-top: 1px solid #333;
-    background: #0f0f0f;
+    100% {
+        transform: translateZ(0);
+    }
 }
 
-.input-label {
-    padding: 8px 20px;
-    font-size: 10px;
-    color: #666;
-    border-bottom: 1px solid #1a1a1a;
-    letter-spacing: 0.5px;
+.analysis-block {
+    margin-top: 12px;
+    border-top: 1px solid #dfd8ca;
+    padding-top: 10px;
 }
 
-.input-area {
-    display: flex;
-    gap: 12px;
-    padding: 16px 20px;
+.analysis-block h3 {
+    margin: 0 0 6px;
+    font-size: 0.92rem;
 }
 
-#messageInput {
-    flex: 1;
-    background: #0a0a0a;
-    border: 1px solid #333;
-    color: #e0e0e0;
-    padding: 10px 12px;
-    font-family: 'Consolas', monospace;
-    font-size: 13px;
+.history-list,
+.capability-list,
+.detail-content {
+    display: grid;
+    gap: 8px;
 }
 
-#messageInput:focus {
-    outline: none;
-    border-color: #4ade80;
+.history-item,
+.capability-item,
+.detail-card {
+    border: 1px solid #e1ddcf;
+    border-radius: 12px;
+    background: rgba(255, 255, 255, 0.88);
+    padding: 10px;
 }
 
-.input-area button {
-    background: #4ade80;
-    color: #0a0a0a;
-    border: none;
-    padding: 10px 24px;
-    font-family: 'Consolas', monospace;
-    font-size: 11px;
-    font-weight: bold;
+.history-item {
     cursor: pointer;
-    transition: all 0.2s;
-    letter-spacing: 0.5px;
+    transition: transform 0.2s ease, border-color 0.2s ease;
 }
 
-.input-area button:hover {
-    background: #22c55e;
+.history-item:hover {
+    transform: translateY(-1px);
+    border-color: #bbd0c9;
 }
 
-/* Right Panel */
-.right-panel {
-    flex: 1;
-    background: #0a0a0a;
+.history-head {
     display: flex;
-    flex-direction: column;
-    overflow-y: auto;
-}
-
-.right-panel::-webkit-scrollbar {
-    width: 6px;
-}
-
-.right-panel::-webkit-scrollbar-track {
-    background: #0a0a0a;
-}
-
-.right-panel::-webkit-scrollbar-thumb {
-    background: #333;
-    border-radius: 3px;
-}
-
-.right-panel .section-header {
-    background: #1a1a1a;
-    padding: 10px 20px;
-    font-size: 11px;
-    font-weight: bold;
-    color: #fff;
-    letter-spacing: 1px;
-    border-bottom: 1px solid #333;
-    border-left: none;
-}
-
-/* Stats Section */
-.stats-section {
-    border-bottom: 1px solid #333;
-}
-
-.stats-grid {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: 1px;
-    background: #1a1a1a;
-    padding: 16px;
-}
-
-.stat-item {
-    background: #0f0f0f;
-    padding: 16px;
-    text-align: center;
-}
-
-.stat-label {
-    font-size: 10px;
-    color: #666;
-    margin-bottom: 8px;
-    letter-spacing: 0.5px;
-}
-
-.stat-value {
-    font-size: 20px;
-    font-weight: bold;
-    color: #4ade80;
+    justify-content: space-between;
+    align-items: center;
+    gap: 6px;
+    margin-bottom: 6px;
 }
 
-/* Threat Section */
-.threat-section {
-    border-bottom: 1px solid #333;
+.badge {
+    display: inline-flex;
+    align-items: center;
+    border-radius: 999px;
+    padding: 3px 9px;
+    font-size: 0.68rem;
+    font-weight: 700;
+    text-transform: uppercase;
 }
 
-.threat-display {
-    padding: 20px;
+.badge.safe {
+    background: #dbf2df;
+    color: #1f6b38;
 }
 
-.threat-meter {
-    height: 32px;
-    background: #0f0f0f;
-    border: 1px solid #333;
-    position: relative;
-    overflow: hidden;
-    margin-bottom: 16px;
+.badge.watch {
+    background: #ffe8bf;
+    color: #8f5a0e;
 }
 
-.threat-fill {
-    height: 100%;
-    width: 0%;
-    transition: width 0.5s ease, background-color 0.3s;
+.badge.danger {
+    background: #ffd8d2;
+    color: #972b21;
 }
 
-.threat-fill.low {
-    background: #4ade80;
+.history-meta,
+.mini-list,
+.conversation-list,
+.indicator-list {
+    margin: 0;
+    padding-left: 16px;
+    color: var(--muted);
+    font-size: 0.8rem;
 }
 
-.threat-fill.medium {
-    background: #fbbf24;
+.mini-list li,
+.conversation-list li,
+.indicator-list li {
+    margin-bottom: 4px;
 }
 
-.threat-fill.high {
-    background: #ff4444;
+.capability-item h4,
+.detail-card h4 {
+    margin: 0 0 6px;
+    font-size: 0.87rem;
 }
 
-.threat-percentage {
-    position: absolute;
-    top: 50%;
-    right: 12px;
-    transform: translateY(-50%);
-    font-size: 13px;
-    font-weight: bold;
-    color: #fff;
-    text-shadow: 0 0 4px #000;
+.capability-summary {
+    margin: 0 0 8px;
+    color: var(--muted);
+    font-size: 0.83rem;
 }
 
-.threat-classification {
+.empty-state {
+    border: 1px dashed #d6cfbe;
+    border-radius: 12px;
+    padding: 18px;
     text-align: center;
-    font-size: 14px;
-    font-weight: bold;
-    padding: 10px;
-    border: 1px solid;
-    border-radius: 2px;
-}
-
-.threat-classification.safe {
-    color: #4ade80;
-    border-color: #4ade80;
-    background: rgba(74, 222, 128, 0.05);
-}
-
-.threat-classification.medium {
-    color: #fbbf24;
-    border-color: #fbbf24;
-    background: rgba(251, 191, 36, 0.05);
-}
-
-.threat-classification.high {
-    color: #ff4444;
-    border-color: #ff4444;
-    background: rgba(255, 68, 68, 0.05);
+    color: var(--muted);
+    font-size: 0.84rem;
 }
 
-/* Data Section */
-.data-section {
-    border-bottom: 1px solid #333;
+.reveal-up {
+    opacity: 0;
+    transform: translateY(10px);
+    animation: revealUp 0.55s forwards;
 }
 
-.data-table {
-    padding: 16px 20px;
+.delay-1 {
+    animation-delay: 0.04s;
 }
 
-.data-row {
-    display: flex;
-    justify-content: space-between;
-    padding: 8px 0;
-    border-bottom: 1px solid #1a1a1a;
+.delay-2 {
+    animation-delay: 0.08s;
 }
 
-.data-row:last-child {
-    border-bottom: none;
+.delay-3 {
+    animation-delay: 0.12s;
 }
 
-.data-label {
-    font-size: 11px;
-    color: #666;
-    letter-spacing: 0.5px;
+.delay-4 {
+    animation-delay: 0.16s;
 }
 
-.data-value {
-    font-size: 12px;
-    color: #fff;
-    font-weight: bold;
+.delay-5 {
+    animation-delay: 0.2s;
 }
 
-/* Intel Section */
-.intel-section {
-    border-bottom: 1px solid #333;
+.delay-6 {
+    animation-delay: 0.24s;
 }
 
-.intel-container {
-    padding: 16px 20px;
-    max-height: 200px;
-    overflow-y: auto;
-}
-
-.intel-container::-webkit-scrollbar {
-    width: 4px;
-}
-
-.intel-container::-webkit-scrollbar-thumb {
-    background: #333;
-}
-
-.intel-empty {
-    font-size: 12px;
-    color: #555;
-    text-align: center;
-    padding: 20px;
-}
-
-.intel-item {
-    font-size: 11px;
-    padding: 8px 12px;
-    margin-bottom: 6px;
-    border-left: 2px solid;
-    background: #0f0f0f;
-    font-family: 'Consolas', monospace;
-}
-
-.intel-item.critical {
-    border-left-color: #ff4444;
-    color: #ff9999;
-    background: rgba(255, 68, 68, 0.05);
-}
-
-.intel-item.info {
-    border-left-color: #60a5fa;
-    color: #93c5fd;
-    background: rgba(96, 165, 250, 0.05);
-}
-
-.intel-item.warning {
-    border-left-color: #fbbf24;
-    color: #fcd34d;
-    background: rgba(251, 191, 36, 0.05);
-}
-
-/* Actions Section */
-.actions-section {
-    padding: 20px;
-    display: flex;
-    flex-direction: column;
-    gap: 12px;
-}
-
-.action-btn {
-    background: transparent;
-    border: 1px solid #4ade80;
-    color: #4ade80;
-    padding: 12px;
-    font-family: 'Consolas', monospace;
-    font-size: 11px;
-    font-weight: bold;
-    cursor: pointer;
-    transition: all 0.2s;
-    letter-spacing: 0.5px;
-}
-
-.action-btn:hover {
-    background: rgba(74, 222, 128, 0.1);
-    box-shadow: 0 0 10px rgba(74, 222, 128, 0.3);
-}
-
-/* Status Bar */
-.status-bar {
-    background: #1a1a1a;
-    border-top: 1px solid #333;
-    padding: 12px 24px;
-    display: flex;
-    justify-content: space-between;
-    font-size: 11px;
-    color: #666;
+@keyframes revealUp {
+    to {
+        opacity: 1;
+        transform: translateY(0);
+    }
 }
 
-.status-left,
-.status-right {
-    display: flex;
-    gap: 24px;
-}
+@media (max-width: 1160px) {
 
-.status-item {
-    display: flex;
-    gap: 8px;
+    .connection-panel,
+    .presence-panel,
+    .analyze-panel,
+    .history-panel,
+    .capabilities-panel,
+    .detail-panel {
+        grid-column: span 6;
+    }
 }
 
-.status-online {
-    color: #4ade80;
-    font-weight: bold;
-}
+@media (max-width: 760px) {
+    body {
+        padding: 10px;
+    }
 
-/* Responsive */
-@media (max-width: 1024px) {
-    .conversation-view {
+    .top-rail {
+        padding: 14px;
         flex-direction: column;
     }
 
-    .sessions-list {
+    .status-cluster {
+        width: 100%;
         grid-template-columns: 1fr;
     }
-}
\ No newline at end of file
+
+    .connection-panel,
+    .presence-panel,
+    .analyze-panel,
+    .history-panel,
+    .capabilities-panel,
+    .detail-panel {
+        grid-column: span 12;
+    }
+
+    .bottom-rail {
+        flex-direction: column;
+        align-items: flex-start;
+    }
+}
diff --git a/pom.xml b/pom.xml
index 85d11a5..6580d99 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,6 +82,18 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-mongodb</artifactId>
         </dependency>
+
+        <!-- Spring Data Redis for distributed caching -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-redis</artifactId>
+        </dependency>
+
+        <!-- Spring Boot Actuator for metrics and health endpoints -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
         
         <!-- Dotenv for loading environment variables from .env file -->
         <dependency>
diff --git a/src/main/java/com/varutri/honeypot/service/core/ConsumerCacheService.java b/src/main/java/com/varutri/honeypot/service/core/ConsumerCacheService.java
index a0c16e8..76f8324 100644
--- a/src/main/java/com/varutri/honeypot/service/core/ConsumerCacheService.java
+++ b/src/main/java/com/varutri/honeypot/service/core/ConsumerCacheService.java
@@ -3,17 +3,29 @@
 import com.varutri.honeypot.dto.ConsumerCapabilitiesResponse;
 import com.varutri.honeypot.dto.ConsumerHistoryDetailResponse;
 import com.varutri.honeypot.dto.ConsumerHistoryItemResponse;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.micrometer.core.instrument.MeterRegistry;
+import jakarta.annotation.PostConstruct;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.data.redis.core.StringRedisTemplate;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Supplier;
 
 /**
- * Lightweight in-memory cache for consumer query responses.
+ * Cache facade for consumer query responses.
+ * Supports MEMORY, REDIS, and HYBRID modes for horizontal scale.
  */
+@Slf4j
 @Service
 public class ConsumerCacheService {
 
@@ -23,60 +35,161 @@ public class ConsumerCacheService {
     @Value("${consumer.cache.capabilities.ttl-seconds:300}")
     private long capabilitiesTtlSeconds;
 
+    @Value("${consumer.cache.backend:MEMORY}")
+    private String cacheBackendRaw;
+
+    @Value("${consumer.cache.key-prefix:varutri:consumer}")
+    private String cacheKeyPrefix;
+
+    private final ObjectMapper objectMapper;
+    private final ObjectProvider<StringRedisTemplate> redisTemplateProvider;
+    private final ObjectProvider<MeterRegistry> meterRegistryProvider;
+
+    private final AtomicLong localHistoryVersion = new AtomicLong(1);
+    private volatile CacheBackend cacheBackend = CacheBackend.MEMORY;
+    private volatile boolean redisFailureLogged;
+
     private final Map<String, CacheEntry<List<ConsumerHistoryItemResponse>>> historyListCache = new ConcurrentHashMap<>();
     private final Map<String, CacheEntry<ConsumerHistoryDetailResponse>> historyDetailCache = new ConcurrentHashMap<>();
     private final Map<String, CacheEntry<ConsumerCapabilitiesResponse>> capabilitiesCache = new ConcurrentHashMap<>();
 
+    public ConsumerCacheService(ObjectMapper objectMapper,
+            ObjectProvider<StringRedisTemplate> redisTemplateProvider,
+            ObjectProvider<MeterRegistry> meterRegistryProvider) {
+        this.objectMapper = objectMapper;
+        this.redisTemplateProvider = redisTemplateProvider;
+        this.meterRegistryProvider = meterRegistryProvider;
+    }
+
+    @PostConstruct
+    void initializeBackend() {
+        this.cacheBackend = CacheBackend.from(cacheBackendRaw);
+        log.info("Consumer cache backend initialized: {}", this.cacheBackend);
+    }
+
     public List<ConsumerHistoryItemResponse> getOrLoadHistoryList(int limit,
             Supplier<List<ConsumerHistoryItemResponse>> loader) {
-        String key = "history:list:" + limit;
+        long version = resolveHistoryVersion();
+        String key = historyListKey(version, limit);
         CacheEntry<List<ConsumerHistoryItemResponse>> entry = historyListCache.get(key);
         if (isValid(entry)) {
+            recordCacheMetric("hit", "memory", "history_list");
             return entry.value();
         }
 
+        if (cacheBackend.usesRedis()) {
+            Optional<List<ConsumerHistoryItemResponse>> redisValue = readRedisValue(
+                    key,
+                    new TypeReference<List<ConsumerHistoryItemResponse>>() {
+                    },
+                    "history_list");
+            if (redisValue.isPresent()) {
+                List<ConsumerHistoryItemResponse> loaded = redisValue.get();
+                historyListCache.put(key, new CacheEntry<>(loaded, nowMs() + historyTtlMs()));
+                recordCacheMetric("hit", "redis", "history_list");
+                return loaded;
+            }
+        }
+
+        recordCacheMetric("miss", "origin", "history_list");
         List<ConsumerHistoryItemResponse> loaded = loader.get();
         historyListCache.put(key, new CacheEntry<>(loaded, nowMs() + historyTtlMs()));
+        recordCacheMetric("write", "memory", "history_list");
+        if (cacheBackend.usesRedis()) {
+            writeRedisValue(key, loaded, historyTtlMs(), "history_list");
+        }
         return loaded;
     }
 
     public ConsumerHistoryDetailResponse getOrLoadHistoryDetail(String sessionId,
             Supplier<ConsumerHistoryDetailResponse> loader) {
-        String key = "history:detail:" + sessionId;
+        long version = resolveHistoryVersion();
+        String key = historyDetailKey(version, sessionId);
         CacheEntry<ConsumerHistoryDetailResponse> entry = historyDetailCache.get(key);
         if (isValid(entry)) {
+            recordCacheMetric("hit", "memory", "history_detail");
             return entry.value();
         }
 
+        if (cacheBackend.usesRedis()) {
+            Optional<ConsumerHistoryDetailResponse> redisValue = readRedisValue(
+                    key,
+                    new TypeReference<ConsumerHistoryDetailResponse>() {
+                    },
+                    "history_detail");
+            if (redisValue.isPresent()) {
+                ConsumerHistoryDetailResponse loaded = redisValue.get();
+                historyDetailCache.put(key, new CacheEntry<>(loaded, nowMs() + historyTtlMs()));
+                recordCacheMetric("hit", "redis", "history_detail");
+                return loaded;
+            }
+        }
+
+        recordCacheMetric("miss", "origin", "history_detail");
         ConsumerHistoryDetailResponse loaded = loader.get();
         historyDetailCache.put(key, new CacheEntry<>(loaded, nowMs() + historyTtlMs()));
+        recordCacheMetric("write", "memory", "history_detail");
+        if (cacheBackend.usesRedis()) {
+            writeRedisValue(key, loaded, historyTtlMs(), "history_detail");
+        }
         return loaded;
     }
 
     public ConsumerCapabilitiesResponse getOrLoadCapabilities(String platform,
             Supplier<ConsumerCapabilitiesResponse> loader) {
-        String key = "capabilities:" + platform;
+        String key = capabilitiesKey(platform);
         CacheEntry<ConsumerCapabilitiesResponse> entry = capabilitiesCache.get(key);
         if (isValid(entry)) {
+            recordCacheMetric("hit", "memory", "capabilities");
             return entry.value();
         }
 
+        if (cacheBackend.usesRedis()) {
+            Optional<ConsumerCapabilitiesResponse> redisValue = readRedisValue(
+                    key,
+                    new TypeReference<ConsumerCapabilitiesResponse>() {
+                    },
+                    "capabilities");
+            if (redisValue.isPresent()) {
+                ConsumerCapabilitiesResponse loaded = redisValue.get();
+                capabilitiesCache.put(key, new CacheEntry<>(loaded, nowMs() + capabilitiesTtlMs()));
+                recordCacheMetric("hit", "redis", "capabilities");
+                return loaded;
+            }
+        }
+
+        recordCacheMetric("miss", "origin", "capabilities");
         ConsumerCapabilitiesResponse loaded = loader.get();
         capabilitiesCache.put(key, new CacheEntry<>(loaded, nowMs() + capabilitiesTtlMs()));
+        recordCacheMetric("write", "memory", "capabilities");
+        if (cacheBackend.usesRedis()) {
+            writeRedisValue(key, loaded, capabilitiesTtlMs(), "capabilities");
+        }
         return loaded;
     }
 
     public void invalidateHistory(String sessionId) {
+        localHistoryVersion.incrementAndGet();
         historyListCache.clear();
-        if (sessionId != null && !sessionId.isBlank()) {
-            historyDetailCache.remove("history:detail:" + sessionId);
+        historyDetailCache.clear();
+        recordCacheMetric("invalidate", "memory", "history");
+
+        if (cacheBackend.usesRedis()) {
+            incrementRedisHistoryVersion();
         }
     }
 
     public void clearAll() {
+        localHistoryVersion.incrementAndGet();
         historyListCache.clear();
         historyDetailCache.clear();
         capabilitiesCache.clear();
+        recordCacheMetric("invalidate", "memory", "all");
+
+        if (cacheBackend.usesRedis()) {
+            incrementRedisHistoryVersion();
+            clearRedisCapabilities();
+        }
     }
 
     private long historyTtlMs() {
@@ -91,10 +204,178 @@ private long nowMs() {
         return System.currentTimeMillis();
     }
 
+    private long resolveHistoryVersion() {
+        if (!cacheBackend.usesRedis()) {
+            return localHistoryVersion.get();
+        }
+
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return localHistoryVersion.get();
+        }
+
+        try {
+            String key = historyVersionKey();
+            String current = redisTemplate.opsForValue().get(key);
+            if (current != null) {
+                long parsed = Long.parseLong(current);
+                localHistoryVersion.updateAndGet(existing -> Math.max(existing, parsed));
+                redisFailureLogged = false;
+                recordCacheMetric("hit", "redis", "history_version");
+                return parsed;
+            }
+
+            long initialized = Math.max(1L, localHistoryVersion.get());
+            redisTemplate.opsForValue().setIfAbsent(key, String.valueOf(initialized));
+            redisFailureLogged = false;
+            recordCacheMetric("write", "redis", "history_version");
+            return initialized;
+        } catch (Exception ex) {
+            logRedisFallback("resolve history version", ex);
+            return localHistoryVersion.get();
+        }
+    }
+
+    private void incrementRedisHistoryVersion() {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+
+        try {
+            redisTemplate.opsForValue().increment(historyVersionKey());
+            redisFailureLogged = false;
+            recordCacheMetric("invalidate", "redis", "history_version");
+        } catch (Exception ex) {
+            logRedisFallback("increment history version", ex);
+        }
+    }
+
+    private void clearRedisCapabilities() {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+
+        try {
+            String pattern = cacheKeyPrefix + ":capabilities:*";
+            var keys = redisTemplate.keys(pattern);
+            if (keys != null && !keys.isEmpty()) {
+                redisTemplate.delete(keys);
+            }
+            redisFailureLogged = false;
+            recordCacheMetric("invalidate", "redis", "capabilities");
+        } catch (Exception ex) {
+            logRedisFallback("clear capabilities cache", ex);
+        }
+    }
+
+    private String historyVersionKey() {
+        return cacheKeyPrefix + ":history:version";
+    }
+
+    private String historyListKey(long version, int limit) {
+        return cacheKeyPrefix + ":history:list:v" + version + ":" + limit;
+    }
+
+    private String historyDetailKey(long version, String sessionId) {
+        return cacheKeyPrefix + ":history:detail:v" + version + ":" + sessionId;
+    }
+
+    private String capabilitiesKey(String platform) {
+        return cacheKeyPrefix + ":capabilities:" + platform;
+    }
+
+    private <T> Optional<T> readRedisValue(String key, TypeReference<T> typeReference, String segment) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return Optional.empty();
+        }
+
+        try {
+            String payload = redisTemplate.opsForValue().get(key);
+            if (payload == null || payload.isBlank()) {
+                recordCacheMetric("miss", "redis", segment);
+                return Optional.empty();
+            }
+            T parsed = objectMapper.readValue(payload, typeReference);
+            redisFailureLogged = false;
+            return Optional.ofNullable(parsed);
+        } catch (Exception ex) {
+            logRedisFallback("read cache key " + key, ex);
+            return Optional.empty();
+        }
+    }
+
+    private void writeRedisValue(String key, Object value, long ttlMs, String segment) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+
+        try {
+            String payload = objectMapper.writeValueAsString(value);
+            redisTemplate.opsForValue().set(key, payload, ttlMs, TimeUnit.MILLISECONDS);
+            redisFailureLogged = false;
+            recordCacheMetric("write", "redis", segment);
+        } catch (Exception ex) {
+            logRedisFallback("write cache key " + key, ex);
+        }
+    }
+
+    private void logRedisFallback(String action, Exception ex) {
+        if (!redisFailureLogged) {
+            redisFailureLogged = true;
+            log.warn("Redis cache operation failed during '{}'. Falling back to in-memory cache: {}",
+                    action,
+                    ex.getMessage());
+            recordCacheMetric("fallback", "redis", "operation");
+        } else {
+            log.debug("Redis cache operation failed during '{}': {}", action, ex.getMessage());
+        }
+    }
+
+    private void recordCacheMetric(String outcome, String layer, String segment) {
+        MeterRegistry meterRegistry = meterRegistryProvider.getIfAvailable();
+        if (meterRegistry == null) {
+            return;
+        }
+
+        meterRegistry.counter(
+                "varutri.consumer.cache.operations",
+                "outcome", outcome,
+                "layer", layer,
+                "segment", segment,
+                "backend", cacheBackend.name().toLowerCase())
+                .increment();
+    }
+
     private boolean isValid(CacheEntry<?> entry) {
         return entry != null && entry.expiresAtEpochMs() > nowMs();
     }
 
+    private enum CacheBackend {
+        MEMORY,
+        REDIS,
+        HYBRID;
+
+        static CacheBackend from(String raw) {
+            if (raw == null || raw.isBlank()) {
+                return MEMORY;
+            }
+
+            try {
+                return CacheBackend.valueOf(raw.trim().toUpperCase());
+            } catch (IllegalArgumentException ex) {
+                return MEMORY;
+            }
+        }
+
+        boolean usesRedis() {
+            return this == REDIS || this == HYBRID;
+        }
+    }
+
     private record CacheEntry<T>(T value, long expiresAtEpochMs) {
     }
 }
\ No newline at end of file
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index e485e58..4a1a4a4 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -35,8 +35,22 @@ varutri.api-key=${VARUTRI_API_KEY}
 consumer.auth.token.secret=${CONSUMER_AUTH_TOKEN_SECRET:${VARUTRI_API_KEY}}
 consumer.auth.token.ttl-minutes=240
 consumer.auth.allowed-app-ids=varutri-mobile,varutri-extension,varutri-web
+consumer.cache.backend=${CONSUMER_CACHE_BACKEND:MEMORY}
+consumer.cache.key-prefix=${CONSUMER_CACHE_KEY_PREFIX:varutri:consumer}
 consumer.cache.history.ttl-seconds=45
 consumer.cache.capabilities.ttl-seconds=300
+spring.data.redis.host=${REDIS_HOST:localhost}
+spring.data.redis.port=${REDIS_PORT:6379}
+spring.data.redis.username=${REDIS_USERNAME:}
+spring.data.redis.password=${REDIS_PASSWORD:}
+spring.data.redis.database=${REDIS_DATABASE:0}
+spring.data.redis.ssl.enabled=${REDIS_SSL_ENABLED:false}
+spring.data.redis.timeout=2s
+spring.data.redis.connect-timeout=2s
+
+# Cache/operations observability
+management.endpoints.web.exposure.include=health,info,metrics
+management.endpoint.health.show-details=never
 
 # ===========================================
 # Local ML Model Configuration (DJL)