feat: comprehensive fixes - remove passwordHash, move capacitor CLI, delete pnpm-lock, add JSDoc, remove BOM

Co-authored-by: aimenng <141473804+aimenng@users.noreply.github.com>

Author: Copilot

authContext.tsx

@@ -121,6 +121,11 @@ export const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children
     });
   }, [refreshAuthData]);
 
+  /**
+   * Local-only check: returns true when `email` matches a user already loaded
+   * into the auth state (current user or their partner).  This does NOT query
+   * the backend, so it cannot detect emails registered by other accounts.
+   */
   const isEmailTaken = (email: string) =>
     users.some((u) => u.email.toLowerCase() === email.toLowerCase());
 

backend/src/mappers.js

@@ -4,7 +4,6 @@ export const mapUser = (row) => {
   return {
     id: row.id,
     email: row.email,
-    passwordHash: '',
     invitationCode: row.invitation_code || '',
     boundInvitationCode: row.bound_invitation_code || '',
     emailVerified: Boolean(row.email_verified),

backend/src/routes/appRoutes.js

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from 'express';
 import crypto from 'node:crypto';
 import { requireAuth } from '../auth.js';
 import { mapEvent, mapMemory, mapNotification, mapSettings } from '../mappers.js';

backend/src/routes/authRoutes.js

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from 'express';
 import bcrypt from 'bcryptjs';
 import { requireAuth, signToken } from '../auth.js';
 import { mapUser } from '../mappers.js';

package.json

@@ -24,7 +24,6 @@
   },
   "dependencies": {
     "@capacitor/android": "^8.1.0",
-    "@capacitor/cli": "^7.5.0",
     "@capacitor/core": "^8.1.0",
     "@supabase/supabase-js": "^2.95.3",
     "@vercel/analytics": "^1.6.1",
@@ -44,6 +43,7 @@
     "react-dom": "^19.2.4"
   },
   "devDependencies": {
+    "@capacitor/cli": "^7.5.0",
     "@types/node": "^22.14.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",