feat: comprehensive security and architecture improvements

- Add Zod validation schemas with strong password requirements (12+ chars, complexity)
- Implement rate limiting for authentication endpoints (registration, password reset)
- Remove duplicate MetricCard component, consolidate to ui/metric-card.tsx
- Update README.md to use pnpm commands consistently
- Enhance authentication security with 12-round bcrypt hashing
- Add comprehensive input validation for all API endpoints
- Fix security vulnerabilities in user registration and password reset flows

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/setup.ts

@@ -1,5 +1,5 @@
 // Vitest test setup
-import { vi } from 'vitest';
+import { vi } from "vitest";
 
 // Mock console methods to reduce noise in tests
 global.console = {
@@ -10,8 +10,8 @@ global.console = {
 };
 
 // Set test environment variables
-process.env.NEXTAUTH_SECRET = 'test-secret';
-process.env.NEXTAUTH_URL = 'http://localhost:3000';
+process.env.NEXTAUTH_SECRET = "test-secret";
+process.env.NEXTAUTH_URL = "http://localhost:3000";
 
 // Use test database for all database operations during tests
 if (process.env.DATABASE_URL_TEST) {
@@ -19,6 +19,6 @@ if (process.env.DATABASE_URL_TEST) {
 }
 
 // Mock node-fetch for transcript fetcher tests
-vi.mock('node-fetch', () => ({
+vi.mock("node-fetch", () => ({
   default: vi.fn(),
 }));