chore(architecture): clean verified demo codebase

## Summary

- Consolidate demo auth, route metadata, report export helpers, and release docs into reusable modules.
- Remove stale docs, generated reports, unused assets, dead components, orphan hooks, and unused dependencies.
- Fix remaining action gaps across reports, backups, audit filters, uploaded-file management, profile dialogs, and settings controls.

## Changes Made
### Architecture

- Centralized seeded demo account metadata and role route mapping.
- Moved app route definitions into a reusable route registry.
- Added typed report export filtering and simplified dashboard data shaping.

### Cleanup

- Removed stale release notes, old evidence files, generated Playwright report output, unused UI modules, orphan hooks, and unused bucket/database helpers.
- Optimized PWA/fav icon assets and removed unused React/logo source assets.
- Removed unused dependencies from package metadata and lockfile.

### Product Fixes

- Wired admin audit-log email and action filters.
- Enabled backup export, report date filtering, faculty dark mode, uploaded-file category persistence/removal, and profile dialog close/accessibility behavior.
- Suppressed expected optional missing profile-image noise while preserving real storage error logging.

### Verification

- Added unit coverage for reusable auth/routes/report helpers.
- Added Playwright coverage for admin action controls, management exports, faculty settings, profile edits, and uploaded-file persistence.

## Why

- The project needed a cleaner plug-and-play structure, less stale surface area, smaller asset/dependency footprint, and stronger E2E evidence for user-facing controls.

## Notes for Reviewers

- Remaining unused-export scan findings are intentionally retained shared UI primitive exports for future component reuse.
- Final verification before commit passed lint, unit tests, security scan, SEO/link checks, audit, build, and both local and Pages-style Playwright runs.

Author: Iron-Mark

.gitignore

@@ -1,8 +1,10 @@
 node_modules
 dist
 dist-ssr
+playwright-report
+test-results
 *.local
 .env
 .env.*
 .DS_Store
-.vscode/
+.vscode/

README.md

@@ -20,7 +20,7 @@ Public showcase URL: https://iron-mark.github.io/Hackathon-Smart-Profile-Managem
 
 Release checkpoint: [`v2.1.1`](https://github.com/Iron-Mark/Hackathon-Smart-Profile-Management-System/releases/tag/v2.1.1)
 
-Release evidence: [`docs/release-evidence-v2.1.1.md`](docs/release-evidence-v2.1.1.md)
+Release status: [`docs/release-status.md`](docs/release-status.md)
 
 The public build is intentionally demo-only. It uses seeded reviewer accounts, browser-local demo storage, generated sample files, and deterministic AI/OCR fallbacks when private API keys are not configured. There is no supported hosted persistence path in this showcase branch.
 
@@ -126,7 +126,7 @@ For a concise showcase script, see `docs/demo-checklist.md`.
 For public reviewer notes, see `docs/PUBLIC_DEMO.md`.
 For demo backend limitations, see `docs/demo-backend.md`.
 For optional Clerk identity and Organization controls, see `docs/clerk-showcase-auth.md`.
-For the verified release checkpoint, see `docs/release-evidence-v2.1.1.md`.
+For the verified release checkpoint and current release gate, see `docs/release-status.md`.
 The README screenshots are maintained in `docs/images/login.png`, `docs/images/profile.png`, and `docs/images/dashboard.png`.
 
 ### Performance And Web Vitals

docs/post-deploy-review.md

@@ -0,0 +1,71 @@
+# Release Status
+
+Current public showcase:
+
+https://iron-mark.github.io/Hackathon-Smart-Profile-Management-System/
+
+## Current Release
+
+- Latest documented checkpoint: `v2.1.1`
+- GitHub release: https://github.com/Iron-Mark/Hackathon-Smart-Profile-Management-System/releases/tag/v2.1.1
+- Release commit: `09573665db005f4a1114dcaf9606886a7cfbc73f`
+- Public runtime model: static GitHub Pages app with browser-local demo storage
+
+## What The Release Captures
+
+- Faculty credential upload, admin review, approval tracking, and faculty status visibility.
+- Seeded reviewer accounts plus browser-local public registration.
+- Browser-local submissions, audit logs, upload metadata, profile data, and small file previews.
+- Generated sample credentials only. Public reviewers should not upload real IDs, transcripts, licenses, or faculty records.
+- Optional local Clerk sign-in/sign-up showcase; admin access remains the seeded admin demo account.
+- Optional local OpenAI experimentation; missing keys use deterministic demo fallbacks.
+- Public SEO/AEO/GEO sources through landing-page facts, FAQ JSON-LD, `answers.md`, `llms.txt`, sitemap, robots, and social preview metadata.
+- Local Web Vitals panel backed by the official `web-vitals` package.
+
+## Verification Gate
+
+Run the local gate before tagging, publishing, or claiming a release is current:
+
+```bash
+npm ci
+npm test -- --run
+npm run lint
+npm run security:scan
+npm run seo:check
+npm run links:check
+npm run build
+npx playwright test
+```
+
+For GitHub Pages-style local QA, use the build preview commands in `docs/demo-checklist.md`.
+
+## Last Recorded Live Evidence
+
+The `v2.1.1` checkpoint was previously verified against GitHub Pages with:
+
+- Full live Playwright suite: `17 passed`
+- Landing page and app deep links returning HTTP 200 through static fallbacks
+- Generated sample files returning HTTP 200
+- `answers.md`, `llms.txt`, `sitemap.xml`, `robots.txt`, and `og-image.png` returning HTTP 200
+- Mobile landing and faculty dashboard smoke checks
+- No required backend secrets for the public build
+
+Treat these as release evidence for the historical checkpoint. Re-run the verification gate before making a fresh current-state claim.
+
+## Release Safety Notes
+
+- This repository is a static public demo, not production authentication, authorization, audit logging, or document storage.
+- Uploaded demo files and account state stay in the visitor's current browser.
+- Clerk Organizations are showcase context only and do not grant admin access.
+- Browser-exposed OpenAI keys are for local experimentation only; production use would require a server-side proxy.
+
+## Future Release Checklist
+
+1. Confirm the worktree is clean except intended release changes.
+2. Run the full verification gate.
+3. Build and test with the GitHub Pages base path from `docs/demo-checklist.md`.
+4. Merge the verified branch into the publish branch.
+5. Wait for GitHub Pages deployment to finish.
+6. Re-run the live Playwright suite against the public URL.
+7. Confirm public assets and sample files return HTTP 200.
+8. Tag only the verified commit.