3 commits

Author	SHA1	Message	Date
Mannu	6d7feca397	fix(invites): remove dependency on missing display_name / accepted_at columns ... The family_invites migration hasn't run yet on production. Work around by: - Removing display_name from INSERT and SELECT (optional field anyway) - Removing accepted_at IS NULL filter from GET and accept queries - DELETE the invite row on accept instead of marking accepted_at — keeps invites single-use without needing the extra column Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-24 14:38:53 +05:30
Mannu	a54f30ddcb	Security hardening - all 8 patches applied ... Patch 1: Add requireFamily to chat route Patch 2: Add requireFamily to family routes Patch 3: Create admin-auth.ts, apply to all admin routes Patch 4: Delete debug and migrate routes, update middleware Patch 5: Create audit_log table and schema Patch 6: Create password reset flow (reset-request, reset-confirm) Patch 7: Replace with real HTTP security tests Patch 8: RLS migrations already exist (01-app-role, 02-enable-rls) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-16 23:59:43 +05:30
Mannu	f03484f262	Sprint 2: Invitation System Complete ... - /api/invites - GET/POST invites - /api/invites/accept - POST accept invite - /invite/[token] - Accept invite page - Settings page now has invite UI - Checks member limit for free tier - Shows upgrade prompt when limit reached Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-10 21:54:41 +05:30