feat: comprehensive security and architecture improvements

- Add Zod validation schemas with strong password requirements (12+ chars, complexity)
- Implement rate limiting for authentication endpoints (registration, password reset)
- Remove duplicate MetricCard component, consolidate to ui/metric-card.tsx
- Update README.md to use pnpm commands consistently
- Enhance authentication security with 12-round bcrypt hashing
- Add comprehensive input validation for all API endpoints
- Fix security vulnerabilities in user registration and password reset flows

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

components/MessageViewer.tsx

@@ -49,7 +49,9 @@ export default function MessageViewer({ messages }: MessageViewerProps) {
                   {message.role}
                 </span>
                 <span className="text-xs opacity-75 ml-2">
-                  {message.timestamp ? new Date(message.timestamp).toLocaleTimeString() : 'No timestamp'}
+                  {message.timestamp
+                    ? new Date(message.timestamp).toLocaleTimeString()
+                    : "No timestamp"}
                 </span>
               </div>
               <div className="text-sm whitespace-pre-wrap">
@@ -63,13 +65,18 @@ export default function MessageViewer({ messages }: MessageViewerProps) {
       <div className="mt-4 pt-3 border-t text-sm text-gray-500">
         <div className="flex justify-between">
           <span>
-            First message: {messages[0].timestamp ? new Date(messages[0].timestamp).toLocaleString() : 'No timestamp'}
+            First message:{" "}
+            {messages[0].timestamp
+              ? new Date(messages[0].timestamp).toLocaleString()
+              : "No timestamp"}
           </span>
           <span>
             Last message:{" "}
             {(() => {
               const lastMessage = messages[messages.length - 1];
-              return lastMessage.timestamp ? new Date(lastMessage.timestamp).toLocaleString() : 'No timestamp';
+              return lastMessage.timestamp
+                ? new Date(lastMessage.timestamp).toLocaleString()
+                : "No timestamp";
             })()}
           </span>
         </div>