Cleanup: drop Vercel path, wire rate-limit env vars, add tests, harden CI, refresh docs

[devin-ai-integration]

Summary

Cleanup/docs/CI third of the security review. No runtime behaviour change for anyone using the defaults; the one deployment-relevant change is that the repo is now explicitly Cloudflare Pages only.

Removed dead Vercel deployment path — api/ (4 files, incl. the un-rate-limited generate-worksheet.js copy and two duplicate health handlers), vercel.json, .vercelignore, root tsconfig.json (only included api/**/*.ts), client vercel-build script. Also dropped start-dev.js (superseded by root npm run dev), server/package.json.backup, server/tsconfig.node.json (Vite leftover, server has no vite config). Root package.json still lists cors/dotenv/express (only api/ used them) — left alone to avoid a lockfile conflict with #28; trivial follow-up once that lands.

Rate-limit env vars are now real — .env.example/README documented WORKSHEET_RATE_LIMIT_* / GENERAL_RATE_LIMIT_* but nothing read them.

// server/src/middleware/rateLimiting.ts
const envInt = (name, fallback) => /* unset/'' → fallback; else must be a positive integer or throw at startup */
export const WORKSHEET_RATE_LIMIT_WINDOW_MS   = envInt('WORKSHEET_RATE_LIMIT_WINDOW_MS', 3_600_000)
export const WORKSHEET_RATE_LIMIT_MAX_REQUESTS = envInt('WORKSHEET_RATE_LIMIT_MAX_REQUESTS', 10)
export const GENERAL_RATE_LIMIT_WINDOW_MS      = envInt('GENERAL_RATE_LIMIT_WINDOW_MS', 900_000)
export const GENERAL_RATE_LIMIT_MAX_REQUESTS   = envInt('GENERAL_RATE_LIMIT_MAX_REQUESTS', 100)

worksheetSlowDown shares the worksheet window; 429 messages are derived from the configured values. MAX_REQUEST_SIZE was never implemented on either runtime (both hard-code 1 KB) so it's removed from the docs rather than wired.

Dev-port drift fixed — .env.example, both READMEs and the Vite proxy said 3000; the server and client constants use 3001. The Vite proxy also had rewrite: path.replace(/^\/api/, ''), which would have hit /generate-worksheet (404) had anything used it — removed. .env.example now says up front that it belongs at server/.env (where config/index.ts actually loads it).

Tests (new, run in CI via npm test)

• test/cloudflare-function.test.mjs — imports onRequestPost/onRequestOptions directly with an in-memory KV and a stubbed globalThis.fetch for OpenAI: invalid bodies → 400 without an upstream call; happy path returns the worksheet + RateLimit-*; upstream error is masked; 11th request in a window → 429; foreign origin 403 / allow-listed origin 204.
• server/src/middleware/validation.test.ts — worksheetRequestSchema against every UI grade label, bare grades/bands, length bounds, filter words, complexity enum, .strict().
• server/src/middleware/rateLimiting.test.ts — defaults, overrides, and startup failure on 0 / -5 / 1.5 / ten (each case in a child process since limits are read at import).
• Runner is node:test (node --import tsx --test on the server). New server/tsconfig.eslint.json includes test files so ESLint's typed parsing and a tsc --noEmit -p tsconfig.eslint.json cover them without emitting them into dist/.

CI / supply chain — permissions: contents: read, actions/checkout + actions/setup-node pinned to v4.4.0 commit SHAs, persist-credentials: false, Dependabot github-actions ecosystem added, removed the step that loaded the deleted Vercel handler, smoke test also asserts /favicon.svg (index.html pointed at a non-existent /vite.svg; a small favicon.svg is added under server/client/public/).

Docs — root README rewritten around the actual stack (React 19 / Vite 8 / Tailwind 4 / Express 5 / Node 22, Cloudflare Pages + Functions + KV, 3001) with a step-by-step Pages deployment section (encrypted OPENAI_API_KEY, RATE_LIMIT_KV binding, WAF rate rule, OpenAI spend cap). server/README.md replaced (it described Docker/PM2/models/app.ts that don't exist) with an accurate layout + API reference. Note: the README's security section describes the state after #27 and #28 land (Helmet, _headers, TRUST_PROXY, output validation).

Verified locally on Node 24: npm test (15 tests pass), server tsc incl. tests, eslint . (0 errors), client tsc + vite build (favicon in dist/), production server with WORKSHEET_RATE_LIMIT_MAX_REQUESTS=2 → third request 429 with the derived message.

Link to Devin session: https://app.devin.ai/sessions/9385fb134d5f4dacb30bc28bd6bede11
Open in Devin Desktop: https://app.devin.ai/desktop/session/9385fb134d5f4dacb30bc28bd6bede11?variant=devin
Requested by: @southbayjay

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring