Harden MarketMind for production readiness

[Taz33m]

Summary

• add production-safe local authentication while retaining Clerk for hosted identity
• make option execution, paper portfolio mutations, public API quotas, persistence, and alert scheduling safe under production concurrency
• bound expensive ML/provider work and enforce structured request, authorization, error, liveness, and readiness contracts
• migrate the frontend from Create React App to Vite with durable URL routing, resilience boundaries, Vitest coverage, and Playwright journeys
• reduce critical backend complexity, extract Flask runtime concerns, and align the production roadmap and operations docs

Audit issues

Completed and closed: #176, #177, #178, #179, #180, #181, #182, #183, #184, #185, #186, #187, and #188.

Impact

MarketMind now has a reproducible Node 24/Vite frontend build, production-enforced PostgreSQL and Redis configuration, atomic user-state transitions, a singleton alert worker, bounded external work, stable API contracts, dependency and coverage gates, and a maintainability ceiling that prevents new grade-F Python callables. Local development remains self-contained through a capability-scoped local identity and can use SQL-backed SQLite for features that require relational storage.

Validation

• PYTHON_BIN=python3 bash backend/run_deterministic_backend_checks.sh: 204 tests passed, 62% branch-aware coverage
• Ruff passed and complexity guard found zero production callables above 40
• python3 -m pip_audit -r backend/requirements.txt --strict: no known vulnerabilities
• bash frontend/run_frontend_checks.sh: 53 suites and 238 tests passed, all coverage floors passed, Vite production build passed
• npm audit --audit-level=moderate: zero vulnerabilities
• npm run test:e2e: Playwright local sign-in, navigation, search, and paper-buy journey passed
• live localhost smoke: /healthz, /readyz, local /auth/me, SQL-backed MarketMindAI bootstrap, frontend routing, desktop layout, and responsive DOM passed

Operational note

The local live-data smoke encountered Yahoo Finance 429 responses for dashboard/screener widgets. Deterministic provider tests and the browser journey pass; the app shell continues rendering and reports the provider failure. The GitHub backend workflow remains authoritative for the Docker image build and PostgreSQL migration smoke.