fix: security hardening, validation, cache and analytics fixes

Backend security:
- Admin-gate /admin/redundancy (GET+POST) with zod validation and tool existence checks
- Restrict CORS to same-origin (plus CORS_ORIGIN allowlist) and SameSite=Lax cookie
- Validate returnTo to prevent open redirect in the OIDC flow
- Validate/coerce relations body, reject self-relations and non-admin 'recommended'
- Add central JSON error middleware (no more Express HTML 500s)
- Fail fast at startup when SESSION_SECRET/VOTER_SECRET missing in production

Backend correctness:
- Stop leaking voterToken in the create-rating response
- Allow clearing websiteUrl/iconUrl (nullable in UpdateToolBody, frontend sends null)
- Regenerate session after login/callback (session fixation) and add OIDC state check
- Block self-demotion and last-admin demotion in user PATCH
- Set created_by to NULL on user delete (FK-safe)
- Validate cost create/update bodies with zod
- Unique index (tool_id, voter_token) + 409 on race duplicate ratings
- Clamp audit limit, escape ilike wildcards in search, O(N) analytics queries

Frontend:
- tools-browse reads and syncs URL query params (fixes home 'View all' links)
- Invalidate analytics/top-tools/categories/features caches after mutations
- Sync category combobox input when the value changes externally
- Hide Write a Review for anonymous users, drop unreachable rating guard

artifacts/toolrate/src/components/category-combobox.tsx

@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useEffect } from "react";
 import { Check, ChevronsUpDown } from "lucide-react";
 import { cn } from "@/lib/utils";
 import { Button } from "@/components/ui/button";
@@ -26,6 +26,11 @@ interface CategoryComboboxProps {
 export function CategoryCombobox({ value, onChange, placeholder = "Select or type a category..." }: CategoryComboboxProps) {
   const [open, setOpen] = useState(false);
   const [inputValue, setInputValue] = useState(value);
+
+  useEffect(() => {
+    setInputValue(value);
+  }, [value]);
+
   const categories = useListCategories({
     query: {
       queryKey: getListCategoriesQueryKey(),

artifacts/toolrate/src/pages/tool-detail.tsx

@@ -7,7 +7,11 @@ import {
   getListToolRatingsQueryKey,
   useGetRatingDistribution,
   getGetRatingDistributionQueryKey,
-  useCreateRating
+  useCreateRating,
+  getGetTopToolsQueryKey,
+  getGetAnalyticsSummaryQueryKey,
+  getListCategoriesQueryKey,
+  getListAllFeaturesQueryKey
 } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
 import { useForm } from "react-hook-form";
@@ -214,15 +218,6 @@ export default function ToolDetail() {
   });
 
   const onSubmit = (data: RatingFormValues) => {
-    if (data.usefulness === 0 || data.usability === 0) {
-      toast({
-        title: "Missing ratings",
-        description: "Please rate both usefulness and usability.",
-        variant: "destructive"
-      });
-      return;
-    }
-
     createRating.mutate({ id, data }, {
       onSuccess: () => {
         toast({
@@ -236,6 +231,8 @@ export default function ToolDetail() {
         queryClient.invalidateQueries({ queryKey: getGetToolQueryKey(id) });
         queryClient.invalidateQueries({ queryKey: getListToolRatingsQueryKey(id) });
         queryClient.invalidateQueries({ queryKey: getGetRatingDistributionQueryKey({ toolId: id }) });
+        queryClient.invalidateQueries({ queryKey: getGetTopToolsQueryKey() });
+        queryClient.invalidateQueries({ queryKey: getGetAnalyticsSummaryQueryKey() });
       },
       onError: (error) => {
         toast({
@@ -277,6 +274,10 @@ export default function ToolDetail() {
         onSuccess: () => {
           toast({ title: "Tool deleted" });
           queryClient.invalidateQueries({ queryKey: getListToolsQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getListCategoriesQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getListAllFeaturesQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetTopToolsQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetAnalyticsSummaryQueryKey() });
           setLocation("/tools");
         },
         onError: (err) => {
@@ -711,7 +712,7 @@ export default function ToolDetail() {
             <div className="lg:col-span-2 space-y-6">
               <div className="flex justify-between items-center">
                 <h3 className="text-2xl font-bold">Reviews</h3>
-                {!isReviewFormOpen && (
+                {!isReviewFormOpen && user && (
                   <Button onClick={() => setIsReviewFormOpen(true)}>Write a Review</Button>
                 )}
               </div>

artifacts/toolrate/src/pages/tool-edit.tsx

@@ -10,6 +10,8 @@ import {
   getListToolsQueryKey,
   getListCategoriesQueryKey,
   getListAllFeaturesQueryKey,
+  getGetTopToolsQueryKey,
+  getGetAnalyticsSummaryQueryKey,
 } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
 
@@ -92,8 +94,8 @@ export default function ToolEdit() {
   const onSubmit = (data: ToolFormValues) => {
     const payload = {
       ...data,
-      websiteUrl: data.websiteUrl || undefined,
-      iconUrl: data.iconUrl || undefined,
+      websiteUrl: data.websiteUrl?.trim() ? data.websiteUrl : null,
+      iconUrl: data.iconUrl?.trim() ? data.iconUrl : null,
       features: data.features?.map((f) => f.value).filter((v) => v.trim() !== ""),
       tags: data.tags?.map((t) => t.value).filter((v) => v.trim() !== ""),
     };
@@ -107,6 +109,8 @@ export default function ToolEdit() {
           queryClient.invalidateQueries({ queryKey: getListToolsQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListCategoriesQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListAllFeaturesQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetTopToolsQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetAnalyticsSummaryQueryKey() });
           setLocation(`/tools/${id}`);
         },
         onError: (err) => {

artifacts/toolrate/src/pages/tool-new.tsx

@@ -2,7 +2,7 @@ import { useLocation } from "wouter";
 import { useForm, useFieldArray } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import * as z from "zod";
-import { useCreateTool, getListToolsQueryKey, getListCategoriesQueryKey, getListAllFeaturesQueryKey } from "@workspace/api-client-react";
+import { useCreateTool, getListToolsQueryKey, getListCategoriesQueryKey, getListAllFeaturesQueryKey, getGetTopToolsQueryKey, getGetAnalyticsSummaryQueryKey } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
 
 import { Layout } from "@/components/layout";
@@ -77,6 +77,8 @@ export default function ToolNew() {
           queryClient.invalidateQueries({ queryKey: getListToolsQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListCategoriesQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListAllFeaturesQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetTopToolsQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetAnalyticsSummaryQueryKey() });
           setLocation(`/tools/${newTool.id}`);
         },
         onError: () => {

artifacts/toolrate/src/pages/tools-browse.tsx

@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useEffect } from "react";
 import { 
   useListTools, 
   useListCategories,
@@ -11,13 +11,35 @@ import { Button } from "@/components/ui/button";
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
 import { Skeleton } from "@/components/ui/skeleton";
 import { Search, Wrench, SlidersHorizontal, X } from "lucide-react";
-import { Link } from "wouter";
+import { Link, useLocation, useSearch } from "wouter";
+
+const SORT_VALUES = new Set<string>([ListToolsSort.newest, ListToolsSort.top_rated, ListToolsSort.most_reviewed]);
 
 export default function ToolsBrowse() {
-  const [search, setSearch] = useState("");
-  const [searchInput, setSearchInput] = useState("");
-  const [category, setCategory] = useState<string>("all");
-  const [sort, setSort] = useState<ListToolsSort>(ListToolsSort.newest);
+  const [, navigate] = useLocation();
+  const urlSearch = useSearch();
+
+  const initialParams = new URLSearchParams(urlSearch);
+  const initialSearch = initialParams.get("search") ?? "";
+  const initialCategory = initialParams.get("category") ?? "all";
+  const initialSortParam = initialParams.get("sort") ?? "";
+  const initialSort = SORT_VALUES.has(initialSortParam)
+    ? (initialSortParam as ListToolsSort)
+    : ListToolsSort.newest;
+
+  const [search, setSearch] = useState(initialSearch);
+  const [searchInput, setSearchInput] = useState(initialSearch);
+  const [category, setCategory] = useState<string>(initialCategory);
+  const [sort, setSort] = useState<ListToolsSort>(initialSort);
+
+  useEffect(() => {
+    const p = new URLSearchParams();
+    if (search) p.set("search", search);
+    if (category && category !== "all") p.set("category", category);
+    if (sort && sort !== ListToolsSort.newest) p.set("sort", sort);
+    const qs = p.toString();
+    navigate(qs ? `/tools?${qs}` : "/tools", { replace: true });
+  }, [search, category, sort]);
 
   const { data: categories, isLoading: loadingCategories } = useListCategories();