Security, stability and performance quick wins

[Sparksx]

Summary

Comprehensive codebase audit across security, stability, performance, and functionality — this PR implements the highest-priority quick wins identified.

Security

• Enable CSP headers in production (was fully contentSecurityPolicy: false)
• Hash refresh tokens (SHA-256) before storing in DB — a DB leak no longer exposes reusable tokens
• Restrict JWT verification to HS256 — prevents algorithm confusion attacks
• Add stricter rate limiting on game state saves (30/min, on top of the global 100/min)
• Server-side gold check for clan creation — was previously deducted client-side only; a crafted POST could create a clan for free

Stability

• Wrap admin gold/essence/diamonds modifications in transactions — the previous read-then-write pattern was vulnerable to race conditions under concurrent requests
• Wrap clan leave + ownership transfer in a single transaction — prevents double-disband or orphaned clan state when two members leave simultaneously
• Wrap payment refund clawback in a transaction — prevents negative gold from concurrent state modifications during refund processing
• Fix new player starting gold — createDefaultGameState set gold to 0 instead of the intended STARTING_GOLD (100)

Performance

• Cache Stripe SDK instance — was recreated on every payment request
• Add aggressive caching for Vite hashed assets (max-age=1y, immutable) — previously served with no cache headers
• Remove redundant DB queries in chat socket handlers — role is already available on socket.user.role from connection middleware; two handlers were re-querying it on every call
• Add missing index on Purchase.stripePaymentId — used by the refund webhook for lookups, was doing a full table scan

Test plan

• All 524 existing tests pass (npm test)
• Lint passes with 0 errors (npm run lint)
• Production build succeeds (npm run build)
• Verify auth flow (register/login/refresh/logout) works with hashed refresh tokens
• Verify clan creation deducts gold server-side
• Verify CSP headers don't block legitimate resources in production

🤖 Generated with Claude Code

https://claude.ai/code/session_017uNVMci3uw2PAKcThpwjce

---

Generated by Claude Code