feat: added the login/signup pages and dashboard's

[vij-sameerb5]

Component Name

N/A — infrastructure PR. Adds auth, database, dashboards and admin.

Description

Zepa goes from a static registry to an application with accounts.

Clerk for auth (v7, scaffolded with clerk init), Neon + Drizzle for
user data, /dashboard and /admin, bookmarks, a code gate, GA4 analytics,
and a pre-launch security pass.

Fixes a live production bug: views, likes and installs were writing to
data/component-stats.json — a serverless container's throwaway filesystem.
Every one of those events recorded in production was being discarded.
lib/stats/store.ts is deleted; all four counters now persist in Neon.

Architecture in backend.md, failure log in dev-journal.md (both gitignored).

Added

• proxy.ts, /sign-in, /sign-up, <UserButton> popup
• lib/db/ — schema, client, server-only queries
• /api/bookmarks, /api/webhooks/clerk
• /dashboard — overview, bookmarks, submissions, settings
• /admin — overview, component stats, users, submissions, analytics
• lib/analytics/ga4.ts — Data API via self-signed JWT, no SDK
• lib/rate-limit.ts, security headers, code gate
• ⌘K search palette restored; mobile drawer for /components

Changed

• Likes are now user-based (auth required, one per person) rather than an
  anonymous increment anyone could inflate in a loop
• Views: client-fired after 2.5s, throttled per session, plus a server limit
• Preview aspect aspect-video → aspect-[1.74] — recordings are ~1280×735, so
  16:9 had been cropping every preview on the site
• GA measurement ID moved to NEXT_PUBLIC_GA_MEASUREMENT_ID

Preview

Dependencies Added

• @clerk/nextjs
• drizzle-orm, @neondatabase/serverless
• drizzle-kit (dev)

drizzle-orm pinned to 0.45.2 — closes a high SQL-injection advisory.
No GA SDK: the Data API is called directly with node:crypto.

Checklist

• Added meta.ts — n/a, no new components
• Added demo.tsx — n/a
• Added preview — n/a
• Ran npm run build:registry
• Ran npm run lint
• Ran npm run test — 23 passing
• Ran npm run build — 175 pages, TypeScript passes
• Responsive (mobile + desktop) — /components gets a drawer below lg
• No console.log
• No hardcoded secrets/API keys — git log --all -S across 5 patterns → 0 commits
• No unnecessary dependencies
• No unnecessary hardcoded colors/assets

Security

• userId always from auth(), never a request body
• /admin role checked server-side in layout and every page; unauthorised
  gets notFound(), not 403
• Drizzle parameterized queries throughout
• Rate limits: view 30/min, install 20/min, like 30/min, bookmark 40/min per IP
• Headers: X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, HSTS
• CORS: none set — same-origin only
• npm audit: 16 → 4 (remaining are esbuild in drizzle-kit's dev-only chain;
  do not run audit fix --force — it downgrades drizzle-kit and breaks db:push)

Deploy requirements

Netlify env vars — the build fails without DATABASE_URL (it throws at
module load):

[netlify]

✅ Deploy Preview for zepaui ready!

Name	Link
🔨 Latest commit	0452623
🔍 Latest deploy log	https://app.netlify.com/projects/zepaui/deploys/6a947a1f58169f0008335a5a
😎 Deploy Preview	https://deploy-preview-45--zepaui.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.