feat(brand): infrastructure + email migration for Deck Hearth (B2 of 2)

Closes the pick-a-name convoy. Applies D1-D5 + Risk 4 PRESERVE per
operator gate-1 ratification.

Infrastructure renames:
- lib/rate-limit.js: 5 Redis key prefixes tcgvault:* → deckhearth:* (D5).
  One-time per-15-min / per-1-hour counter reset accepted; no user impact
  because counter windows are short anyway. Existing rate-limit state in
  Upstash will accumulate at the new prefix on first request.
- package.json: name field tcg-vault → deck-hearth (D2)
- package-lock.json: regenerated for the name change; STOP-on-churn
  protocol confirmed only the two name lines changed (no dep churn)
- All three test users (admin/alice/bob) renamed to @deckhearth.com (D4)
- One-off migration script scripts/migrations/2026-05-24-rename-admin-
  email.js (NEW): ESM, idempotent, UNIQUE-collision-safe. Per the
  no-go-zones rule for new migrations. Operator MUST run post-deploy.
- README.md + TESTING_GUIDE.md operator-caveat blockquotes flagged
- pages/login.js demo-credential pre-fill updated

PRESERVED per Risk 4:
- test/lib/permission-middleware.test.js literal admin@tcgvault.com
  with 7-line architect-authored "why" comment block. This is the
  documented pre-fix-auth-bypass bug shape; the regression-lock
  literal stays as historical truth.

Verification:
- npm run lint: 128 problems (baseline preserved)
- npm run test:run: 21/21 pass (preserved literal keeps green)
- Grep across full repo: 0 hits for TCG Vault / tcgvault / tcg-vault
  except the explicit preserve in the test file + .convoys/ historical
- lib/rate-limit.js: 5 deckhearth: prefixes, 0 tcgvault: prefixes
- node --check on the new migration script: exit 0
- git diff package-lock.json: only the 2 "name": lines changed (no churn)

Operator post-merge action:
- Run `node scripts/migrations/2026-05-24-rename-admin-email.js` against
  the production Neon DB. Order matters: migration FIRST, then any
  subsequent `npm run setup-db` invocation. Migration script will refuse
  to run if collision detected (means setup-db already ran post-rename).

Architect brief: .convoys/pick-a-name/brief-2-infrastructure-and-email-migration.md
Architect commit: 50ce9ab
Operator gate-1: D1-D5 + Risk 4 PRESERVE ratified.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1,4 +1,4 @@
-# TCG Vault
+# Deck Hearth
 
 A modern trading card game collection manager built with Next.js and Neon Database.
 
@@ -129,7 +129,7 @@ variable is unset or empty.
 - **CI / Vercel:** set `ADMIN_INITIAL_PASSWORD` as a project secret if setup
   ever runs from CI. The env var is **only** read by the seed script; runtime
   auth uses the per-user password stored in the database.
-- **Admin email:** the seed creates `admin@tcgvault.com`. Change the password
+- **Admin email:** the seed creates `admin@deckhearth.com`. Change the password
   immediately after first login via the app's profile settings.
 
 > **Operators of envs that pre-date this change:** `npm run setup-db` is
@@ -140,6 +140,17 @@ variable is unset or empty.
 > after logging in, or wait for the queued `rotate-default-admin` follow-up
 > convoy.
 
+> **Operators of envs that pre-date the `pick-a-name` convoy (2026-05-24):**
+> the admin row was renamed from `admin@tcgvault.com` to
+> `admin@deckhearth.com`. Run
+> `node scripts/migrations/2026-05-24-rename-admin-email.js` once after
+> deploy to UPDATE any existing `@tcgvault.com` user rows (the admin row,
+> plus alice/bob if `npm run create-test-users` was ever run). Re-running
+> the migration after the first run is idempotent and prints "Nothing to
+> migrate." Verify post-migration with
+> `psql $POSTGRES_URL -c "SELECT email FROM users WHERE email LIKE '%@tcgvault.com'"`
+> — expect zero rows.
+
 ## 🤝 Contributing
 
 1. Fork the repository

TESTING_GUIDE.md

@@ -1,12 +1,12 @@
-# 🎯 TCG Vault Collaboration Testing Guide
+# 🎯 Deck Hearth Collaboration Testing Guide
 
 ## 👥 Test Accounts
 
 | User | Email | Password | Role |
 |------|-------|----------|------|
-| Admin | `admin@tcgvault.com` | `admin123` | Admin |
-| Alice | `alice@tcgvault.com` | `alice123` | User |
-| Bob | `bob@tcgvault.com` | `bob123` | User |
+| Admin | `admin@deckhearth.com` | `admin123` | Admin |
+| Alice | `alice@deckhearth.com` | `alice123` | User |
+| Bob | `bob@deckhearth.com` | `bob123` | User |
 
 ## 🃏 Sample Cards Available
 
@@ -21,7 +21,7 @@
 
 ### 1. **Login as Alice**
 ```
-Email: alice@tcgvault.com
+Email: alice@deckhearth.com
 Password: alice123
 ```
 
@@ -43,14 +43,14 @@ Password: alice123
 
 ### 4. **Invite Bob as Collaborator**
 - Click "Invite Collaborator" button
-- Enter: `bob@tcgvault.com`
+- Enter: `bob@deckhearth.com`
 - Role: Collaborator (default)
 - Message: "Help me build this Pokemon collection!"
 - Click "Send Invitation"
 
 ### 5. **Switch to Bob's Account**
 - Logout and login as Bob
-- Email: `bob@tcgvault.com`
+- Email: `bob@deckhearth.com`
 - Password: `bob123`
 
 ### 6. **Accept Invitation (Simulated)**

lib/rate-limit.js

@@ -7,11 +7,11 @@ import { Redis } from '@upstash/redis';
 // classes to match Brief 4's existing algorithm; switching to
 // `tokenBucket` per-class would be its own convoy.
 const LIMITER_CONFIG = {
-  auth:     { limit: 5,  window: '15 m', prefix: 'tcgvault:auth' },
-  search:   { limit: 60, window: '1 m',  prefix: 'tcgvault:search' },
-  upload:   { limit: 10, window: '1 h',  prefix: 'tcgvault:upload' },
-  generate: { limit: 5,  window: '1 h',  prefix: 'tcgvault:generate' },
-  import:   { limit: 5,  window: '1 h',  prefix: 'tcgvault:import' },
+  auth:     { limit: 5,  window: '15 m', prefix: 'deckhearth:auth' },
+  search:   { limit: 60, window: '1 m',  prefix: 'deckhearth:search' },
+  upload:   { limit: 10, window: '1 h',  prefix: 'deckhearth:upload' },
+  generate: { limit: 5,  window: '1 h',  prefix: 'deckhearth:generate' },
+  import:   { limit: 5,  window: '1 h',  prefix: 'deckhearth:import' },
 };
 
 // Lazy singleton. Module-load init would throw in environments without

package-lock.json

@@ -1,11 +1,11 @@
 {
-  "name": "tcg-vault",
+  "name": "deck-hearth",
   "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "tcg-vault",
+      "name": "deck-hearth",
       "version": "0.1.0",
       "dependencies": {
         "@neondatabase/serverless": "^1.0.1",

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "tcg-vault",
+  "name": "deck-hearth",
   "version": "0.1.0",
   "private": true,
   "type": "module",

pages/login.js

@@ -169,7 +169,7 @@ export default function Login() {
                   <div className="grid grid-cols-2 gap-3">
                     <button
                       type="button"
-                      onClick={() => handleQuickLogin('alice@tcgvault.com', 'alice123')}
+                      onClick={() => handleQuickLogin('alice@deckhearth.com', 'alice123')}
                       className="px-4 py-2 rounded-lg text-sm font-medium border border-opacity-20 transition-all duration-200 hover:shadow-md backdrop-blur-sm hover:bg-opacity-80"
                       style={{
                         backgroundColor: 'rgba(var(--bg-primary-rgb), 0.6)',
@@ -181,7 +181,7 @@ export default function Login() {
                     </button>
                     <button
                       type="button"
-                      onClick={() => handleQuickLogin('bob@tcgvault.com', 'bob123')}
+                      onClick={() => handleQuickLogin('bob@deckhearth.com', 'bob123')}
                       className="px-4 py-2 rounded-lg text-sm font-medium border border-opacity-20 transition-all duration-200 hover:shadow-md backdrop-blur-sm hover:bg-opacity-80"
                       style={{
                         backgroundColor: 'rgba(var(--bg-primary-rgb), 0.6)',

scripts/create-test-users.js

@@ -15,25 +15,25 @@ async function createTestUsers() {
     const alicePassword = await bcrypt.hash('alice123', 12);
     await sql`
       INSERT INTO users (email, password, role)
-      VALUES ('alice@tcgvault.com', ${alicePassword}, 'user')
+      VALUES ('alice@deckhearth.com', ${alicePassword}, 'user')
       ON CONFLICT (email) DO NOTHING
     `;
-    console.log('✅ Created Alice (alice@tcgvault.com / alice123)');
+    console.log('✅ Created Alice (alice@deckhearth.com / alice123)');
 
     // Create Bob (collaborator)  
     const bobPassword = await bcrypt.hash('bob123', 12);
     await sql`
       INSERT INTO users (email, password, role)
-      VALUES ('bob@tcgvault.com', ${bobPassword}, 'user')
+      VALUES ('bob@deckhearth.com', ${bobPassword}, 'user')
       ON CONFLICT (email) DO NOTHING
     `;
-    console.log('✅ Created Bob (bob@tcgvault.com / bob123)');
+    console.log('✅ Created Bob (bob@deckhearth.com / bob123)');
 
     console.log('\n🎉 Test users created successfully!');
     console.log('\n👥 Available Test Accounts:');
-    console.log('   1. admin@tcgvault.com / admin123 (Admin)');
-    console.log('   2. alice@tcgvault.com / alice123 (User)');
-    console.log('   3. bob@tcgvault.com / bob123 (User)');
+    console.log('   1. admin@deckhearth.com / admin123 (Admin)');
+    console.log('   2. alice@deckhearth.com / alice123 (User)');
+    console.log('   3. bob@deckhearth.com / bob123 (User)');
 
   } catch (error) {
     console.error('❌ Failed to create test users:', error.message);

scripts/migrations/2026-05-24-rename-admin-email.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+
+/**
+ * Migration: 2026-05-24 — Rename @tcgvault.com user emails to @deckhearth.com
+ *
+ * Part of the `pick-a-name` convoy. Renames every `users.email` row matching
+ * `%@tcgvault.com` to the `@deckhearth.com` equivalent (admin + alice + bob,
+ * plus any other accidentally-`@tcgvault.com` users if they exist).
+ *
+ * Idempotent: re-running after the first run prints "Nothing to migrate."
+ *
+ * Usage:
+ *   node scripts/migrations/2026-05-24-rename-admin-email.js
+ *
+ * Required env: POSTGRES_URL (read from .env.local).
+ *
+ * Safety: the UPDATE uses REPLACE() so emails like `admin@tcgvault.com`
+ * become `admin@deckhearth.com`. The `users.email` UNIQUE constraint will
+ * fail loudly if a row with the target email already exists — which is the
+ * correct behavior (do NOT silently overwrite). If you see the constraint
+ * violation, inspect the DB manually before retrying.
+ */
+
+import dotenv from 'dotenv';
+dotenv.config({ path: '.env.local' });
+
+import { neon } from '@neondatabase/serverless';
+
+async function main() {
+  if (!process.env.POSTGRES_URL) {
+    console.error('❌ POSTGRES_URL is not set. Set it in .env.local before running this migration.');
+    process.exit(1);
+  }
+
+  const sql = neon(process.env.POSTGRES_URL);
+
+  const { rows: before } = await sql`
+    SELECT id, email, role
+    FROM users
+    WHERE email LIKE '%@tcgvault.com'
+    ORDER BY id
+  `;
+
+  if (before.length === 0) {
+    console.log('✅ Nothing to migrate. No users with @tcgvault.com emails found.');
+    return;
+  }
+
+  console.log(`Found ${before.length} user(s) with @tcgvault.com emails:`);
+  for (const r of before) {
+    console.log(`  id=${r.id}  role=${r.role}  email=${r.email}`);
+  }
+
+  await sql`
+    UPDATE users
+    SET email = REPLACE(email, '@tcgvault.com', '@deckhearth.com'),
+        updated_at = CURRENT_TIMESTAMP
+    WHERE email LIKE '%@tcgvault.com'
+  `;
+
+  const { rows: after } = await sql`
+    SELECT id, email, role
+    FROM users
+    WHERE email LIKE '%@deckhearth.com'
+    ORDER BY id
+  `;
+
+  console.log(`✅ Migrated ${before.length} user(s). Post-migration @deckhearth.com rows:`);
+  for (const r of after) {
+    console.log(`  id=${r.id}  role=${r.role}  email=${r.email}`);
+  }
+
+  const { rows: stragglers } = await sql`
+    SELECT COUNT(*)::int AS count FROM users WHERE email LIKE '%@tcgvault.com'
+  `;
+  if (stragglers[0].count !== 0) {
+    console.warn(`⚠️  ${stragglers[0].count} @tcgvault.com row(s) still present after migration — investigate.`);
+    process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  console.error('❌ Migration failed:', err);
+  process.exit(1);
+});

scripts/reset-db.js

@@ -144,7 +144,7 @@ async function resetDatabase() {
     
     await sql`
       INSERT INTO users (email, password, role) 
-      VALUES (${'admin@tcgvault.com'}, ${hashedPassword}, ${'admin'})
+      VALUES (${'admin@deckhearth.com'}, ${hashedPassword}, ${'admin'})
     `;
     console.log('✅ Created admin user');
 
@@ -152,7 +152,7 @@ async function resetDatabase() {
     console.log('');
     console.log('📋 Database Details:');
     console.log('   Database: Neon PostgreSQL');
-    console.log('   Admin User: admin@tcgvault.com');
+    console.log('   Admin User: admin@deckhearth.com');
     console.log('   Admin Password: admin123');
 
   } catch (error) {

scripts/setup-neon-db.js

@@ -145,7 +145,7 @@ async function setupNeonDatabase() {
     
     await sql`
       INSERT INTO users (email, password, role) 
-      VALUES (${'admin@tcgvault.com'}, ${hashedPassword}, ${'admin'})
+      VALUES (${'admin@deckhearth.com'}, ${hashedPassword}, ${'admin'})
       ON CONFLICT (email) DO NOTHING
     `;
     console.log('✅ Created admin user');
@@ -154,7 +154,7 @@ async function setupNeonDatabase() {
     console.log('');
     console.log('📋 Database Details:');
     console.log('   Database: Neon PostgreSQL');
-    console.log('   Admin user ready (email: admin@tcgvault.com)');
+    console.log('   Admin user ready (email: admin@deckhearth.com)');
     console.log('');
     console.log('🔧 Next Steps:');
     console.log('   1. Test the API endpoints');

test/lib/permission-middleware.test.js

@@ -82,6 +82,13 @@ describe('getUserFromRequest', () => {
 
   it('does NOT return the synthetic admin shape when no Authorization header is present (Brief 2 regression lock)', async () => {
     const user = await getUserFromRequest({ headers: {} });
+    // Email literal is the OLD `admin@tcgvault.com` (pre-`pick-a-name`
+    // convoy, 2026-05-24) — preserved as the exact pre-fix-auth-bypass
+    // synthetic-admin shape this assertion locks against. The
+    // `.toBeNull()` check below is the strong contract; this soft check
+    // documents the historical bug. Do NOT update to
+    // `admin@deckhearth.com` — that would weaken the regression-lock to
+    // a shape that never actually existed.
     expect(user).not.toEqual({
       userId: 1,
       email: 'admin@tcgvault.com',