Align project structure and Supabase runtime

README.md

@@ -46,8 +46,10 @@ ExamGuard Pro is an advanced, real-time exam monitoring and proctoring system th
 │   ├── core/                # Event bus (Redis), risk engine, rate limiting, lifespan
 │   ├── schemas/             # Pydantic request/response schemas
 │   ├── services/            # AI pipeline: face_detection, gaze_tracking, ocr,
-│   │   └── agents/          #   object_detection, page_classifier, transformer_analysis,
-│   │                        #   and site-classification agents
+│   │   ├── agents/          #   object_detection, page_classifier, transformer_analysis,
+│   │   │                    #   and site-classification agents
+│   │   └── weights/         # Downloaded model artifacts (ignored by Git)
+│   ├── reports/templates/   # Jinja2 report templates used by report workers
 │   ├── workers/             # Celery workers: face, object, gaze, ocr, nlp, report, cleanup
 │   ├── migrations/          # SQL schema (supabase_schema.sql, 0001_init.sql)
 │   ├── tests/               # Pytest suite (Supabase mocked)
@@ -85,8 +87,9 @@ cd server
 python -m venv .venv
 source .venv/bin/activate  # On Windows: .venv\Scripts\activate
 pip install -r requirements.txt
-# Optional: configure .env (copy from .env.example) with SUPABASE_URL,
-# SUPABASE_KEY (service_role), and PG_* pooler credentials.
+# Configure server/.env (copy from server/.env.example) with the new
+# SUPABASE_URL, SUPABASE_SECRET_KEY, SUPABASE_JWKS_URL, and PG_* pooler
+# credentials. Keep SUPABASE_SECRET_KEY server-side only.
 python setup_database.py --seed-admin   # or paste migrations/supabase_schema.sql in the Supabase SQL Editor
 python -m uvicorn main:app --host 127.0.0.1 --port 8000 --reload
 ```
@@ -104,6 +107,9 @@ docker run -p 6379:6379 redis:7-alpine    # or .\scripts\start-redis.ps1
 # Terminal 2 — worker (from server/ with venv active)
 celery -A workers.celery_app worker --loglevel=info -Q face,object,gaze,ocr,nlp,report,default -c 2
 ```
+Model weights belong in `server/services/weights/` and are intentionally not
+committed. The MediaPipe face landmarker bundle remains at
+`server/services/face_landmarker.task` for compatibility.
 Or run the whole stack with one command: `docker compose up --build` (API + Redis + worker + beat).
 
 ### 4. Frontend Setup
@@ -122,6 +128,13 @@ Other scripts: `npm run test` (Vitest), `npm run lint` (TypeScript check).
 3. Click **Load unpacked** and select the `extension/` directory — no build step required.
 4. The backend URL defaults to `http://127.0.0.1:8000` (see `BACKEND_URL` in `extension/background.js`).
 
+The V2 API exposes authenticated telemetry upload routes at
+`/api/v1/uploads/screenshot`, `/api/v1/uploads/webcam`, and
+`/api/v1/uploads/latest/{session_id}?type=screenshot|webcam`. Uploaded frames
+are stored under `server/uploads/` locally and broadcast over the session
+WebSocket; production deployments should use object storage for durable
+retention.
+
 ## 🧪 Testing
 ```bash
 cd server && python -m pytest tests/ -v     # backend (Supabase mocked, no services needed)
@@ -137,7 +150,8 @@ The repo ships a Render blueprint (`render.yaml`) — a single Python web servic
 2. Build command: `bash build.sh` — installs Python deps, builds the dashboard, pre-downloads YOLO weights.
 3. Start command: `bash start.sh` — runs `uvicorn main:app` from the repo root on `$PORT`.
 4. Configure environment variables (secrets should be set in the Render dashboard, not committed):
-   - `SUPABASE_URL`, `SUPABASE_KEY` (service role recommended)
+   - `SUPABASE_URL`, `SUPABASE_SECRET_KEY`, `SUPABASE_JWKS_URL`
+   - `SUPABASE_PUBLISHABLE_KEY` only where a browser-side Supabase client is used
    - `PG_HOST`, `PG_PORT`, `PG_USER`, `PG_DB`, `PG_PASSWORD` (Supabase pooler, for direct DB access)
    - `SECRET_KEY` (auto-generated by the blueprint)
    - `CORS_ORIGINS` (comma-separated allowed origins)