feat: Sprints 24-29A — comprehensive review, security, a11y, skills, UI components - #4

…nhanced focus states

Frontend: floating A11yStatusBadge shows active persona + features count,
PersonaExplainer banner explains current theme adaptations, theme color preview
chips on preferences panel, WCAG-compliant focus with outline+offset and
forced-colors support. 19 new tests (11 badge + 8 explainer), 13 i18n keys
across EN/PT-BR/ES.

Backend: GET /capabilities public endpoint returning platform feature
availability (LLM, TTS, image gen, vector search, braille, skills, demo mode),
config validation at startup, /capabilities excluded from rate limiting and
tenant context middleware. 3 new API tests.

All tests green: 2,406 backend + 1,397 frontend. TypeScript 0 errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

FEATURES.md: Added F-223 to F-229 (improvements branch features).
TODO.md: Sprint 27 "Production-Grade Polish" plan — 13 features in 4 phases
(backend hardening, frontend premium polish, API/observability, cleanup).
Based on GPT-5.2 backend architecture + frontend UX expert reviews.
CHANGELOG.md: v0.13.0 entry with all changes from improvements branch.
SYSTEM_DESIGN.md: Capabilities discovery endpoint + accessibility status system.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ThemeCompareSlider: draggable split-pane comparing standard theme vs
active persona theme. Shows sample content (card, heading, button,
badges) rendered with each theme's CSS variables inline. Keyboard
accessible (Arrow Left/Right), clamped 5-95%, ARIA slider role.
Integrated into Settings > Accessibility section.

14 tests, 4 i18n keys across EN/PT-BR/ES. TypeScript 0 errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- api.ts: VALID_DEMO_PROFILES includes both short (login page) and long
  (landing page) format keys to match backend demo_profiles.py
- evidence-panel.tsx: add missing id attr on toggle button so
  aria-labelledby="evidence-btn-{id}" resolves correctly
- preferences-panel.tsx: fix stale-closure focus-restore bug by using
  direct branch instead of useEffect cleanup
- auth.py: mint iss/aud claims in JWT when AILINE_JWT_ISSUER /
  AILINE_JWT_AUDIENCE env vars are configured

Tests: 2,406 backend + 1,411 frontend = 3,817 green, 0 failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Backend:
- POST /auth/demo-login: proper JWT flow with short/long key aliases
- Demo users seeded with hashed password (demo123) for email login
- /auth/demo-login excluded from tenant middleware
- Login rate limit raised to 20/min for demo-friendly Docker testing
- 7 new demo-login tests (all profiles, short aliases, JWT validity)

Frontend:
- Landing + login pages upgraded to use /auth/demo-login (JWT-first, X-Teacher-ID fallback)
- Pipeline SVG connectors with dash-flow animation on active edges
- Node glow effects (active=warning, completed=success, failed=error)
- btn-press micro-interaction (scale 0.97 on active)
- Motor accessibility (F-235): pill-shaped buttons, 3px focus halos,
  8px tap zone indicators, bottom action bar padding
- demoLogin() async helper in api.ts with auth store integration

Infra:
- Frontend Docker memory 512M → 2G
- NODE_OPTIONS=--max-old-space-size=1536
- Healthcheck fallback: wget || curl

Tests: 2,413 backend + 1,411 frontend = 3,824 green, 0 failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Teacher Journey and Accessibility Showcase tracks with rich
storyboard panel, step navigation, track badges, and full i18n
(EN/PT-BR/ES). Fix startDemo() signature, demoLogin mock, and
TS cast in api.ts. 1,426 frontend + 2,413 backend tests green.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…-230)

- Add SessionFactoryUserRepository (session-per-call, mirrors SkillRepo pattern)
- Add DI wiring in app.py (_wire_user_repo) with PostgreSQL guard
- Remove asyncio.Lock from auth endpoints (Postgres handles concurrency)
- Add seed_demo_users_async() for Postgres lifespan seeding
- Add set_user_repo/is_user_repo_set helpers for DI injection
- Update _reset_auth_store() to create fresh InMemory between tests
- 5 new tests: protocol compliance, wiring helpers, async seeding

Backend: 2,413 passed | Frontend: 1,411 passed | 0 lint/type errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- MotorStickyToolbar component: scroll-to-top, font +/-, focus toggle
- Only renders when motor persona is active (theme === 'motor')
- Positioned above MobileNav with z-40, backdrop-blur glass effect
- All buttons 56px min with pill-shape, aria-pressed for focus toggle
- Wired into (app) layout between main content and MobileNav
- Full i18n: EN, PT-BR, ES (motor_toolbar namespace)
- 12 tests covering render/hide, actions, disabled states, aria

Frontend: 156 files, 1,438 tests | 0 type errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… F-238)

- Extract _get_skills_info() helper with module-level cache (F-241)
- Replace duplicate SkillRegistry().scan_paths() in /health/diagnostics and /capabilities
- Skills scanned once per process lifetime (GIL-protected atomic dict replace)
- Mark F-238 (RFC 7807) as done — already fully implemented in error_handler.py

Backend: 32 health/diagnostics tests passing | 0 type errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…(F-240)

- Reset auth _user_repo + _login_attempts in test_skills_v1_api and
  test_tenant_context fixtures to prevent cross-module state pollution
- Add DeprecationWarning to legacy get_config() (F-240)
- Update test_config_extended to expect deprecation warning
- All 2,418 backend tests passing, 0 flaky failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…c-ai >=1.62.0

Frontend:
- tailwindcss 4.1.18 → 4.2.0
- @tailwindcss/postcss 4.1.18 → 4.2.0
- motion 12.34.0 → 12.34.2 (a11y fixes)
- next-intl 4.8.2 → 4.8.3

Backend:
- pydantic-ai >=1.58.0 → >=1.62.0
- uvicorn ==0.40.0 → >=0.41.0,<1
- fastapi ==0.129.0 → >=0.129.0,<1

All 3,856 tests green (2,418 backend + 1,438 frontend), 0 TS errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…-239)

F-232: Health Diagnostics Split
- /health/diagnostics is now PUBLIC (no auth): returns status,
  dependency availability (no latency), skill count, uptime, env, version
- /internal/diagnostics requires authentication: returns full operational
  data (latency, LLM config, API key presence, skill names, memory)
- Added /health/diagnostics to _EXCLUDED_EXACT in tenant middleware

F-239: TenantContext Explicit Dependencies
- Eliminated _resolve_teacher_id() anti-pattern from all 4 routers:
  plans.py, plans_stream.py, materials.py, tutors.py
- All endpoints now use Depends(require_authenticated) in signatures
- OpenAPI docs now correctly show auth requirements for all endpoints
- Updated test_error_handler.py to pass auth headers for 422 tests

2,424 backend tests green, 0 failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…-237)

- Added `created_at`, `user_prompt`, `subject` fields to RunTrace entity
- TraceStore.get_or_create() now sets ISO 8601 created_at timestamp
- Pipeline persists user_prompt + subject on trace at run start
- New /runs router:
  - GET /runs — list runs with ?status=running|completed|failed filter,
    limit/offset pagination, tenant-scoped
  - GET /runs/{run_id} — full run detail with trace data
- 16 new tests covering list, detail, filtering, pagination, tenant isolation
- 2,440 backend tests green, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ut endpoint (F-231)

- _create_jwt() now selects RS256 (AILINE_JWT_PRIVATE_KEY) or HS256 (AILINE_JWT_SECRET)
  with dev fallback; every token includes a jti (uuid4) claim
- POST /auth/logout blacklists jti in Redis with TTL = remaining token lifetime
- Middleware checks jti_blacklist:{jti} on every authenticated request (fail-open)
- Settings.jwt_access_ttl_seconds configurable TTL (default 15min prod, 24h dev)
- 5 new tests: jti presence, jti uniqueness, logout ok/auth-required/graceful
- Lint fixes: ternary TTL, unused imports/vars, stale noqa directives

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ync (F-251→F-271)

Phase 1 — Security Containment (6 fixes):
- F-251: Block admin role escalation via demo-login (_validate_role enforcement)
- F-252: TraceStore no longer auto-creates traces from append_node/update_run
- F-253: AILINE_DEV_MODE defaults to false in Docker Compose
- F-254: Shared jwt_dev_secret module replaces hardcoded JWT secrets
- F-255: Per-IP rate limiting on demo-login endpoint (20 req/min)
- F-256: Diagnostics endpoint restricted to admin-only access

Phase 2 — Reliability & Hardening (8 fixes):
- F-257: Rate limiter docstrings aligned (5→20 attempts/minute)
- F-258: EventBus.get_redis_client() protocol method replaces private _redis access
- F-259: TraceStore.list_recent() server-side status filtering
- F-260: Seed imports unified to demo_profiles module
- F-261: _validate_role() raises HTTP 422 for invalid roles (was silent default)
- F-262: plans_stream body immutability via Pydantic model_copy
- F-263: sessionStorage JWT cleanup — removed insecure fallback
- F-264: Docker DB/Redis ports bound to 127.0.0.1

Phase 3 — Docs & i18n Sync (7 fixes):
- F-265: SYSTEM_DESIGN.md version drift fixed (Tailwind, motion, next-intl, pydantic-ai)
- F-266: FEATURES.md Sprint 27 section added
- F-267: SECURITY.md roles updated to 5 (super_admin→parent)
- F-268: RUN_DEPLOY.md port defaults fixed
- F-269: TEST.md counts and commands updated
- F-270: frontend/CLAUDE.md versions synced
- F-271: i18n diacritics fixed (7 pt-BR, 1 es)

Evidence: 2,451 backend tests + 1,438 frontend tests = 3,889 total, 0 failures
Lint: ruff clean, TypeScript clean

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… tests green

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…258/F-261/F-259)

- F-258: Replace getattr(event_bus, "_redis") in _check_redis() with
  public event_bus.get_redis_client() protocol method (app.py)
- F-261: _validate_role() return type str → UserRole for type precision
- F-259: Fix docstring "cursor-based" → "offset-based" pagination (runs.py)

Evidence: 2,451 backend tests passed, ruff clean

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ofiles

- SYSTEM_DESIGN.md: WebSocket path /ws/accessibility/libras → /sign-language/ws/libras-caption
- SYSTEM_DESIGN.md: demo profiles 8→6 (admin profiles removed in F-251)
- SYSTEM_DESIGN.md: structlog 25.4.0→25.5.0, aiosqlite 0.21.0→0.22.1
- SYSTEM_DESIGN.md: pydantic-ai >=1.62.0→>=1.58.0 (align with lockfile)
- SECURITY.md: "All API endpoints" → "All business/data endpoints" + public exceptions
- RUN_DEPLOY.md: db/redis ports now 127.0.0.1:5411/6311 (matches F-264)
- runtime/pyproject.toml: pydantic-ai constraint >=1.62.0→>=1.58.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…factor, UI components, sprint planning

- Security fixes: composite FK/unique constraints migration, security test suite
- Backend: skill repository with proper pagination/filtering, progress store improvements, auth router enhancements
- Frontend: bento dashboard layout, button/card UI components, SSE fetch library, ESLint config updates
- Dependencies: bump agents and runtime packages, update lock files
- Docs: TODO backlog update, FEATURES sync, reference guides (context management, prompt caching, skills)
- Sprint plans: Sprints 29-37 planned (design system, production readiness, architecture evolution, performance, safety, AI intelligence, personalization, UX/accessibility)
- CI: workflow updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>