feat: undo some of the more aggressive changes

Author: edwardlonsdale

CLAUDE.md

@@ -77,7 +77,6 @@ Protected routes: `/accessibility`, `/cookies`, `/privacy`, `/insights`, `/servi
 - **Append-only results tables** — `accessibility_results`, `cookie_results`, `privacy_results` — never UPDATE. UI uses `DISTINCT ON (service_slug)` for latest per service, with pagination (25 per page)
 - **`services` table** — seeded from `services.json`, used by pg-boss worker to look up service data at job processing time
 - **`compliance_urls` table** — tracks discovered and manually overridden URLs for accessibility statements, cookie policies, and privacy notices
-- **`audit_events` table** — logs security-relevant actions (URL overrides) with user, action, JSONB detail, and timestamp
 - **Migrations** in `src/db/migrations/` — numbered SQL files, applied by `src/db/migrate.ts`
 - **Sessions** — `session` table auto-created by `connect-pg-simple`
 

README.md

@@ -55,23 +55,13 @@ npm run db:seed
 
 ## Running locally
 
-### UI only (no worker)
-
 ```bash
 npm run dev
-```
-
-Opens at [http://localhost:3000](http://localhost:3000). This starts only the Express server — no scraping will happen.
-
-### Full app (server + worker)
-
-```bash
+npm run dev:watch
 npm run build && npm start
 ```
 
-Starts the Express server and the pg-boss job worker in the same process. The worker runs 3 concurrent scrape loops and a daily cron at 2am London time.
-
-Trigger checks from the Workers page (all services) or from individual service pages (single service).
+Opens at [http://localhost:3000](http://localhost:3000)
 
 ### Docker Compose
 

src/server/auth.ts

@@ -199,7 +199,7 @@ export function authRouter(config: Config): Router {
     }
   });
 
-  router.post("/logout", (req, res) => {
+  router.get("/logout", (req, res) => {
     req.session.destroy(() => {
       res.redirect("/");
     });

src/server/views/layout.njk

@@ -57,10 +57,7 @@
                 <span class="govuk-header__link">{{ user.name }}</span>
               </li>
               <li class="govuk-header__navigation-item">
-                <form method="post" action="/auth/logout" style="display:inline">
-                  <input type="hidden" name="_csrf" value="{{ csrfToken }}">
-                  <button type="submit" class="govuk-header__link" style="background:none;border:none;cursor:pointer;font:inherit;color:inherit;padding:0;text-decoration:underline;">Sign out</button>
-                </form>
+                <a class="govuk-header__link" href="/auth/logout">Sign out</a>
               </li>
             </ul>
           </nav>

tests/e2e/auth.spec.ts

@@ -9,7 +9,7 @@ test.describe("authentication flow", () => {
 
     await page.waitForURL("**/accessibility");
     await expect(page.getByRole("heading", { level: 1 })).toBeVisible();
-    await expect(page.getByRole("button", { name: "Sign out" })).toBeVisible();
+    await expect(page.getByRole("link", { name: "Sign out" })).toBeVisible();
   });
 
   test("unauthenticated user is redirected to homepage", async ({ page }) => {
@@ -34,7 +34,7 @@ test.describe("authentication flow", () => {
       .click();
     await page.waitForURL("**/accessibility");
 
-    await page.getByRole("button", { name: "Sign out" }).click();
+    await page.getByRole("link", { name: "Sign out" }).click();
     await expect(page).toHaveURL(/\/$/);
 
     await page.goto("/accessibility");