fix: comprehensive security, persistence, and AI authenticity improvements

Security:
- Restrict static serving to ./public/ — .env.local no longer HTTP-accessible
- Real JWT signature verification using jsonwebtoken (not base64 decode)
- Stripe webhook signature verification via stripe.webhooks.constructEvent()
- Add JWT_SECRET, STRIPE_WEBHOOK_SECRET to .env.example

Persistence:
- Replace in-memory Map() database with better-sqlite3 SQLite
- WAL mode + UPSERT prepared statements for atomic operations
- Data persists across server restarts

AI Experience Fix:
- LLM-first planning: Gemini/Groq always called first for all questions
- Hardcoded analytic/heuristic planners are now fallback-only (not default)
- buildAgentTrace() now reflects what actually ran — no more fake static strings
- llmError propagated to agent trace for transparency

Runtime Bug Fixes:
- AbortController on both SSE stream loops prevents zombie LLM token burn on disconnect
- MediaPipe hand tracking fails gracefully with UI fallback (no viewport crash)

Code Quality:
- Remove unused imports in planSchema.js and app.js
- Fix consistent-return lint in auth.js and llmQuota.js

Production:
- GitHub Actions CI pipeline (.github/workflows/ci.yml)
- New env vars documented in .env.example

Author: ShyamAlancode

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Lint & Test
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run ESLint
+        run: npm run lint
+
+      - name: Run test suite
+        run: npm test
+        env:
+          # Use dummy keys so tests that check for env vars don't fail
+          GEMINI_API_KEY: test_key_placeholder
+          GROQ_API_KEY: test_key_placeholder
+          JWT_SECRET: test_jwt_secret_for_ci_only_not_real
+
+  security:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - run: npm ci
+      - name: Audit for high/critical vulnerabilities
+        run: npm audit --audit-level=high

data/mindscape.db

@@ -14,10 +14,13 @@
   "dependencies": {
     "@google/generative-ai": "^0.24.1",
     "@hono/node-server": "^1.13.0",
+    "better-sqlite3": "^13.0.3",
     "dotenv": "^16.4.0",
     "groq-sdk": "^1.1.2",
     "hono": "^4.6.0",
-    "katex": "^0.16.25"
+    "jsonwebtoken": "^9.0.3",
+    "katex": "^0.16.25",
+    "stripe": "^22.4.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.22.0",