Security and code quality fixes: remove passwordHash, GEMINI_API_KEY, unused code, and fix closures

Co-authored-by: aimenng <141473804+aimenng@users.noreply.github.com>

Author: Copilot

authContext.tsx

@@ -75,15 +75,15 @@ export const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children
 
   const unreadCount = useMemo(() => notifications.filter((n) => !n.read).length, [notifications]);
 
-  const resetAuthState = () => {
+  const resetAuthState = useCallback(() => {
     setCurrentUser(null);
     setPartner(null);
     setUsers([]);
     setAllNotifications([]);
     cancelCloudWarmup();
     clearFocusStatsCache();
     clearPeriodTrackerCache();
-  };
+  }, []);
 
   const refreshAuthData = useCallback(async () => {
     const token = getAuthToken();
@@ -112,7 +112,7 @@ export const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children
         resetAuthState();
       }
     }
-  }, []);
+  }, [resetAuthState]);
 
   useEffect(() => {
     refreshAuthData();

context.tsx

@@ -167,15 +167,6 @@ const dedupeRecentDuplicateEvents = (items: AnniversaryEvent[]): AnniversaryEven
   return deduped;
 };
 
-const chunkItems = <T,>(items: T[], size: number): T[][] => {
-  if (size <= 0) return [items];
-  const chunks: T[][] = [];
-  for (let i = 0; i < items.length; i += size) {
-    chunks.push(items.slice(i, i + size));
-  }
-  return chunks;
-};
-
 const estimatePayloadBytes = (payload: unknown): number => {
   try {
     return new Blob([JSON.stringify(payload)]).size;
@@ -686,8 +677,3 @@ export const calculateDateDiff = (targetDate: string): number => {
 
 
 
-
-
-
-
-

types.ts

@@ -12,7 +12,7 @@ export enum View {
 export interface User {
   id: string;
   email: string;
-  passwordHash?: string; // Never store plain password in frontend
+  // NOTE: passwordHash is intentionally excluded from frontend types — it only exists on the backend model.
   invitationCode: string; // User's own unique invite code
   boundInvitationCode?: string; // Invite code from another account that user has bound
   emailVerified?: boolean;

utils/aiService.ts

@@ -1,4 +1,6 @@
 // AI Service for image analysis
+import { getNow } from './timeService';
+
 export interface AIAnalysisResult {
     location?: string;
     date?: string;
@@ -95,8 +97,6 @@ export async function analyzeImage(imageBase64: string): Promise<AIAnalysisResul
     }
 }
 
-import { getNow } from './timeService';
-
 /**
  * Mock analysis for testing (when no API key)
  * Accepts an optional fileDate to use instead of today's date

vite.config.ts

@@ -16,10 +16,6 @@ export default defineConfig(({ mode }) => {
         },
       },
       plugins: [react()],
-      define: {
-        'process.env.API_KEY': JSON.stringify(env.GEMINI_API_KEY),
-        'process.env.GEMINI_API_KEY': JSON.stringify(env.GEMINI_API_KEY)
-      },
       resolve: {
         alias: {
           '@': path.resolve(__dirname, '.'),