fix: security hardening, validation, cache and analytics fixes

Backend security:
- Admin-gate /admin/redundancy (GET+POST) with zod validation and tool existence checks
- Restrict CORS to same-origin (plus CORS_ORIGIN allowlist) and SameSite=Lax cookie
- Validate returnTo to prevent open redirect in the OIDC flow
- Validate/coerce relations body, reject self-relations and non-admin 'recommended'
- Add central JSON error middleware (no more Express HTML 500s)
- Fail fast at startup when SESSION_SECRET/VOTER_SECRET missing in production

Backend correctness:
- Stop leaking voterToken in the create-rating response
- Allow clearing websiteUrl/iconUrl (nullable in UpdateToolBody, frontend sends null)
- Regenerate session after login/callback (session fixation) and add OIDC state check
- Block self-demotion and last-admin demotion in user PATCH
- Set created_by to NULL on user delete (FK-safe)
- Validate cost create/update bodies with zod
- Unique index (tool_id, voter_token) + 409 on race duplicate ratings
- Clamp audit limit, escape ilike wildcards in search, O(N) analytics queries

Frontend:
- tools-browse reads and syncs URL query params (fixes home 'View all' links)
- Invalidate analytics/top-tools/categories/features caches after mutations
- Sync category combobox input when the value changes externally
- Hide Write a Review for anonymous users, drop unreachable rating guard

artifacts/toolrate/src/pages/tool-edit.tsx

@@ -10,6 +10,8 @@ import {
   getListToolsQueryKey,
   getListCategoriesQueryKey,
   getListAllFeaturesQueryKey,
+  getGetTopToolsQueryKey,
+  getGetAnalyticsSummaryQueryKey,
 } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
 
@@ -92,8 +94,8 @@ export default function ToolEdit() {
   const onSubmit = (data: ToolFormValues) => {
     const payload = {
       ...data,
-      websiteUrl: data.websiteUrl || undefined,
-      iconUrl: data.iconUrl || undefined,
+      websiteUrl: data.websiteUrl?.trim() ? data.websiteUrl : null,
+      iconUrl: data.iconUrl?.trim() ? data.iconUrl : null,
       features: data.features?.map((f) => f.value).filter((v) => v.trim() !== ""),
       tags: data.tags?.map((t) => t.value).filter((v) => v.trim() !== ""),
     };
@@ -107,6 +109,8 @@ export default function ToolEdit() {
           queryClient.invalidateQueries({ queryKey: getListToolsQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListCategoriesQueryKey() });
           queryClient.invalidateQueries({ queryKey: getListAllFeaturesQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetTopToolsQueryKey() });
+          queryClient.invalidateQueries({ queryKey: getGetAnalyticsSummaryQueryKey() });
           setLocation(`/tools/${id}`);
         },
         onError: (err) => {