Closes P0 #3 from .convoys/ship-readiness.md.
scripts/setup-neon-db.js:
- Read ADMIN_INITIAL_PASSWORD env var at the top of setupNeonDatabase()
before any DB connection. Fail loudly (process.exit(1)) with an
actionable message if unset or empty.
- Replace bcrypt.hash('admin123', 12) with bcrypt.hash(adminPassword, 12).
- Delete the two console.log lines that echoed admin user + password to
stdout (R3 - stdout leak into CI logs).
- Keep ON CONFLICT (email) DO NOTHING unchanged. Re-running setup-db
on an env with the admin row already present is a no-op for the
password (R4 - silent rotation prevention). Rotation of existing
weak-hash admin rows is out of scope (Decision A - queued for the
rotate-default-admin follow-up convoy).
README.md:
- Add ADMIN_INITIAL_PASSWORD to the install-step env-example block
with a CI-secret note (and add KV_REST_API_URL/KV_REST_API_TOKEN
for completeness; they're optional for local dev).
- Replace the "Default Admin Account" section with "First-time
admin setup", documenting the env var, openssl rand suggestion,
and the operator rotation note for envs that predate this change.
- Zero occurrences of 'admin123' remain in README.md (the operator
rotation note refers to "the prior weak default" instead of naming
the literal string, so grep verification A2 holds).
Decisions A1 (going-forward only), B (operational change allowed),
C1 (no vitest coverage - manual smoke in PR description) per
.convoys/drop-public-setup.md section Decisions.
Smoke output: see PR description.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Redesigned card display with 2.5:3.5 aspect ratio and image-only view
- Added infinite scroll to replace pagination
- Implemented authentic card back placeholders for MTG, Pokemon, and Lorcana
- Added rarity-based particle effects with tiered intensity (mythic/enchanted/rare/uncommon)
- Enhanced hover details panel with structured card information
- Fixed search functionality with debouncing and Enter key support
- Improved filter system with working TCG, rarity, set, and price filters
- Added favorite system for cards in both hover and detail views
- Updated card detail page with comprehensive metadata and actions
- Fixed API filtering with proper Vercel Postgres implementation
- Added particle animations and rarity glow effects
- Improved overall UX with better visual hierarchy and interactions
