fix(review): security hardening + dead-code cleanup

[TortoiseWolfe]

Systematic code review (security / performance / quality / coverage). Findings verified against the actual code before fixing; by-design patterns left untouched.

Security (3 real fixes)

• send-payment-email edge fn — MEDIUM auth bypass. authHeader.includes(serviceRoleKey) was a non-constant-time substring match; with an unset key it coerced to includes("undefined") and matched any header — letting an attacker send arbitrary emails (phishing) from the app domain. Replaced with a guarded, exact, constant-time Bearer-token comparison. ⚠️ Deployed fn — needs redeploy via the Management API after merge.
• group-service.createGroup — PostgREST filter injection. member_ids were interpolated into getConnectedUserIds' .or(...) filter without UUID validation (every sibling service validates). Added a validateUUID guard (after the cheap structural checks, before any query). +injection-guard test.
• SignInForm — fail-open defeated fail-closed rate limiting. The checkRateLimit wrapper is fail-closed by design (blocks on infra outage to stop brute force); SignInForm wrapped it in a fail-open catch that silently disabled brute-force protection on the highest-value target. Removed it — now consistent with SignUp/ForgotPassword, which call it directly.

XSS defense-in-depth

• markdown-processor — blog markdown was injected via dangerouslySetInnerHTML with no HTML sanitization (author-controlled today, but a fork rendering untrusted markdown inherits stored XSS). Added a targeted denylist: strips <script>/<iframe>/<style>/<object>/<embed>/<form>, on*= handlers, and javascript: URIs — while preserving the benign structural tags the blog authors use (<div>/<span>/<details>/<summary>/<br>, verified against committed posts). +6 tests.

Performance

• SEOAnalysisPanel — memoized seoAnalyzer.analyze(post) so the full-body regex analysis doesn't re-run on unrelated re-renders.

Dead code

• Deleted src/config/blog.config.ts (zero importers repo-wide) and src/tests/unit/sync-service.test.ts.backup (stale, no counterpart); removed a commented-out MSW block in src/test/setup.ts.

Verification

• Full vitest suite: 3577 passed / 0 failed (+7 net). Type-check + eslint clean.
• Group-test fixtures updated from fake ids (member-1, …) to valid UUIDs — those ids were never valid; the new guard correctly rejects them.

Deliberately NOT changed (surfaced, not churned)

• ConversationList N+1 (per-conversation count/preview queries) — real, but constrained by a 1s debounce and living in the hook with the load-bearing "no messages-subscription" re-render guard. A real refactor, not a review one-liner.
• Group-messaging not yet implemented throws (message-service) — reachable incomplete work (group E2E crypto); a feature, not a review fix.
• Dead oauth_states table + oauth-state.ts — real CSRF is Supabase PKCE; the custom layer is unused. Deleting a migration table is a bigger call.

Summary

Category	Found	Fixed	Remaining (noted)
Security	5	3	2 by-design (PKCE CSRF, email-keyed lockout)
Performance	3	1	2 (N+1 refactor, trivial re-decrypt cache)
Code Quality	4	4	0
Test Coverage	—	—	0 skips in src/; E2E skips tracked in docs

🤖 Generated with Claude Code