Comprehensive platform review: security fixes, query optimization, UI improvements, and code cleanup

Security (Critical/High):
- Fix path traversal bypass in local storage provider (path.resolve + prefix check)
- Fix timing-unsafe HMAC comparison (crypto.timingSafeEqual)
- Add auth + ownership checks to email API routes (verify-credentials, change-password)
- Remove hardcoded secret key fallback in local storage provider
- Add production credential check for MinIO (fail loudly if not set)
- Remove DB error details from health check response
- Add stricter rate limiting on application submissions (5/hour)
- Add rate limiting on email availability check (anti-enumeration)
- Change getAIAssignmentJobStatus to adminProcedure
- Block dangerous file extensions on upload
- Reduce project list max perPage from 5000 to 200

Query Optimization:
- Optimize analytics getProjectRankings with select instead of full includes
- Fix N+1 in mentor.getSuggestions (batch findMany instead of loop)
- Use _count for files instead of fetching full file records in project list
- Switch to bulk notifications in assignment and user bulk operations
- Batch filtering upserts (25 per transaction instead of all at once)

UI/UX:
- Replace Inter font with Montserrat in public layout (brand consistency)
- Use Logo component in public layout instead of placeholder
- Create branded 404 and error pages
- Make admin rounds table responsive with mobile card layout
- Fix notification bell paths to be role-aware
- Replace hardcoded slate colors with semantic tokens in admin sidebar
- Force light mode (dark mode untested)
- Adjust CardTitle default size
- Improve muted-foreground contrast for accessibility (A11Y)
- Move profile form state initialization to useEffect

Code Quality:
- Extract shared toProjectWithRelations to anonymization.ts (removed 3 duplicates)
- Remove dead code: getObjectInfo, isValidImageSize, unused batch tag functions, debug logs
- Remove unused twilio dependency
- Remove redundant email index from schema
- Add actual storage object deletion when file records are deleted
- Wrap evaluation submit + assignment update in
- Add comprehensive platform review document

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/mentor.ts

@@ -46,36 +46,37 @@ export const mentorRouter = router({
         input.limit
       )
 
-      // Enrich with mentor details
-      const enrichedSuggestions = await Promise.all(
-        suggestions.map(async (suggestion) => {
-          const mentor = await ctx.prisma.user.findUnique({
-            where: { id: suggestion.mentorId },
-            select: {
-              id: true,
-              name: true,
-              email: true,
-              expertiseTags: true,
-              mentorAssignments: {
-                select: { id: true },
-              },
-            },
-          })
+      // Enrich with mentor details (batch query to avoid N+1)
+      const mentorIds = suggestions.map((s) => s.mentorId)
+      const mentors = await ctx.prisma.user.findMany({
+        where: { id: { in: mentorIds } },
+        select: {
+          id: true,
+          name: true,
+          email: true,
+          expertiseTags: true,
+          mentorAssignments: {
+            select: { id: true },
+          },
+        },
+      })
+      const mentorMap = new Map(mentors.map((m) => [m.id, m]))
 
-          return {
-            ...suggestion,
-            mentor: mentor
-              ? {
-                  id: mentor.id,
-                  name: mentor.name,
-                  email: mentor.email,
-                  expertiseTags: mentor.expertiseTags,
-                  assignmentCount: mentor.mentorAssignments.length,
-                }
-              : null,
-          }
-        })
-      )
+      const enrichedSuggestions = suggestions.map((suggestion) => {
+        const mentor = mentorMap.get(suggestion.mentorId)
+        return {
+          ...suggestion,
+          mentor: mentor
+            ? {
+                id: mentor.id,
+                name: mentor.name,
+                email: mentor.email,
+                expertiseTags: mentor.expertiseTags,
+                assignmentCount: mentor.mentorAssignments.length,
+              }
+            : null,
+        }
+      })
 
       return {
         currentMentor: null,