feat(brand): in-repo display + comment sweep for Deck Hearth (B1 of 2)

Mechanical sweep of 7 internal files — AGENTS.md branding note, two
Cursor rules (ui-and-theming, auth-and-permissions), scripts/README.md,
two pages/api/cards/import-* User-Agent strings, scripts/import-lorcana.js
comment block. Applies D1 (Deck Hearth) + D2 (deck-hearth) per operator
gate-1 ratification.

EXCLUDES (B2 owns): lib/rate-limit.js Redis prefix, package.json name,
package-lock.json regen, README.md, TESTING_GUIDE.md, three seed scripts,
pages/login.js demo-credential pre-fill, test/lib/permission-middleware
regression-lock literal (PRESERVED per Risk 4).

Verification:
- npm run lint: 128 problems (baseline preserved)
- npm run test:run: 21/21 pass
- Grep: 0 hits for `TCG Vault` in B1's seven files; expected B2 hits remain
- git diff --name-only matches B1 spec exactly

Architect brief: .convoys/pick-a-name/brief-1-display-and-comment-sweep.md
Architect commit: 50ce9ab
Operator gate-1: D1+D2 ratified.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/auth-and-permissions.mdc

@@ -1,5 +1,5 @@
 ---
-description: Auth model + permission model for tcg-vault (JWT + collection roles)
+description: Auth model + permission model for Deck Hearth (JWT + collection roles)
 globs: pages/api/**/*.js,lib/*.js,components/*.js,pages/*.js
 ---
 

.cursor/rules/ui-and-theming.mdc

@@ -58,4 +58,4 @@ Don't duplicate navigation in a page — extend `NavigationContent` inside Layou
 
 ## Branding
 
-The repo says "TCG Vault" everywhere except `components/Layout.js`, which renders "Deck Hearth" and "DH" logo. A naming convoy is open. Until resolved, **do not introduce a third name** in new copy.
+The canonical product brand is **Deck Hearth** (two words, internal cap), ratified 2026-05-24 in the `pick-a-name` convoy. The repo directory + GitHub project name remain `tcg-vault` until the queued `rename-repo-and-vercel-project` convoy ships. New UI copy MUST use `Deck Hearth` verbatim — do not introduce a third name, do not abbreviate to "DH" outside the logo glyph (currently used in `components/Layout.js` lines 621, 714 as the sidebar logo monogram).

AGENTS.md

@@ -2,7 +2,7 @@
 
 Guidance for agents and humans working in this repo. Prefer existing patterns over new abstractions.
 
-> Branding note: the repo, README, and seed data say "TCG Vault" and `admin@tcgvault.com`, but the Layout component renders "Deck Hearth". Pick one before launch — see `.convoys/` for tracking.
+> Branding note: **Deck Hearth** is the canonical product brand (ratified 2026-05-24 in the `pick-a-name` convoy). The repo directory name `tcg-vault` stays for now — see queued `rename-repo-and-vercel-project`. The seed admin email migrated from `admin@tcgvault.com` to `admin@deckhearth.com` in the same convoy; see Gotcha #4 + `.convoys/pick-a-name.md` for the rotation flow.
 
 ## 1. Project overview
 

pages/api/cards/import-lorcana.js

@@ -11,7 +11,7 @@ async function fetchWithRetry(url, maxRetries = 3, delayMs = 2000) {
     try {
       const response = await fetch(url, {
         headers: {
-          'User-Agent': 'TCG-Vault/1.0',
+          'User-Agent': 'Deck-Hearth/1.0',
           'Accept': 'application/json'
         },
         timeout: 30000 // 30 second timeout

pages/api/cards/import-pokemon.js

@@ -11,7 +11,7 @@ async function fetchWithRetry(url, maxRetries = 3, delayMs = 2000) {
     try {
       const response = await fetch(url, {
         headers: {
-          'User-Agent': 'TCG-Vault/1.0',
+          'User-Agent': 'Deck-Hearth/1.0',
           'Accept': 'application/json'
         },
         timeout: 30000 // 30 second timeout

scripts/README.md

@@ -1,4 +1,4 @@
-# TCG Vault Bulk Import Scripts
+# Deck Hearth Bulk Import Scripts
 
 This directory contains scripts for bulk importing TCG card data into the database.
 

scripts/import-lorcana.js

@@ -17,7 +17,7 @@ async function fetchWithRetry(url, maxRetries = 3, delayMs = 2000) {
     try {
       const response = await fetch(url, {
         headers: {
-          'User-Agent': 'TCG-Vault/1.0',
+          'User-Agent': 'Deck-Hearth/1.0',
           'Accept': 'application/json'
         },
         timeout: 30000 // 30 second timeout