fix: security hardening, validation, cache and analytics fixes

Backend security:
- Admin-gate /admin/redundancy (GET+POST) with zod validation and tool existence checks
- Restrict CORS to same-origin (plus CORS_ORIGIN allowlist) and SameSite=Lax cookie
- Validate returnTo to prevent open redirect in the OIDC flow
- Validate/coerce relations body, reject self-relations and non-admin 'recommended'
- Add central JSON error middleware (no more Express HTML 500s)
- Fail fast at startup when SESSION_SECRET/VOTER_SECRET missing in production

Backend correctness:
- Stop leaking voterToken in the create-rating response
- Allow clearing websiteUrl/iconUrl (nullable in UpdateToolBody, frontend sends null)
- Regenerate session after login/callback (session fixation) and add OIDC state check
- Block self-demotion and last-admin demotion in user PATCH
- Set created_by to NULL on user delete (FK-safe)
- Validate cost create/update bodies with zod
- Unique index (tool_id, voter_token) + 409 on race duplicate ratings
- Clamp audit limit, escape ilike wildcards in search, O(N) analytics queries

Frontend:
- tools-browse reads and syncs URL query params (fixes home 'View all' links)
- Invalidate analytics/top-tools/categories/features caches after mutations
- Sync category combobox input when the value changes externally
- Hide Write a Review for anonymous users, drop unreachable rating guard

lib/api-client-react/src/generated/api.schemas.ts

@@ -144,8 +144,8 @@ export interface ToolUpdate {
   name?: string;
   description?: string;
   category?: string;
-  websiteUrl?: string;
-  iconUrl?: string;
+  websiteUrl?: string | null;
+  iconUrl?: string | null;
   features?: string[];
   tags?: string[];
 }

lib/api-zod/src/generated/api.ts

@@ -105,8 +105,8 @@ export const UpdateToolBody = zod.object({
   "name": zod.string().min(1).optional(),
   "description": zod.string().optional(),
   "category": zod.string().optional(),
-  "websiteUrl": zod.string().optional(),
-  "iconUrl": zod.string().optional(),
+  "websiteUrl": zod.string().nullable().optional(),
+  "iconUrl": zod.string().nullable().optional(),
   "features": zod.array(zod.string()).optional(),
   "tags": zod.array(zod.string()).optional()
 })

lib/db/src/schema/ratings.ts

@@ -1,18 +1,24 @@
-import { pgTable, text, serial, integer, timestamp } from "drizzle-orm/pg-core";
+import { pgTable, text, serial, integer, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
 import { createInsertSchema } from "drizzle-zod";
 import { z } from "zod/v4";
 import { toolsTable } from "./tools";
 
-export const ratingsTable = pgTable("ratings", {
-  id: serial("id").primaryKey(),
-  toolId: integer("tool_id").notNull().references(() => toolsTable.id, { onDelete: "cascade" }),
-  usefulness: integer("usefulness").notNull(),
-  usability: integer("usability").notNull(),
-  comment: text("comment"),
-  reviewerName: text("reviewer_name"),
-  voterToken: text("voter_token"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-});
+export const ratingsTable = pgTable(
+  "ratings",
+  {
+    id: serial("id").primaryKey(),
+    toolId: integer("tool_id").notNull().references(() => toolsTable.id, { onDelete: "cascade" }),
+    usefulness: integer("usefulness").notNull(),
+    usability: integer("usability").notNull(),
+    comment: text("comment"),
+    reviewerName: text("reviewer_name"),
+    voterToken: text("voter_token"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    uniqueIndex("ratings_tool_voter_uniq").on(t.toolId, t.voterToken),
+  ],
+);
 
 export const insertRatingSchema = createInsertSchema(ratingsTable).omit({ id: true, createdAt: true });
 export type InsertRating = z.infer<typeof insertRatingSchema>;

lib/db/src/schema/tool-costs.ts

@@ -11,6 +11,6 @@ export const toolCostsTable = pgTable("tool_costs", {
   currency: text("currency").default("EUR"),
   renewalDate: timestamp("renewal_date", { withTimezone: true }),
   notes: text("notes"),
-  createdBy: integer("created_by").references(() => usersTable.id),
+  createdBy: integer("created_by").references(() => usersTable.id, { onDelete: "set null" }),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 });

lib/db/src/schema/tool-relations.ts

@@ -8,6 +8,6 @@ export const toolRelationsTable = pgTable("tool_relations", {
   relatedToolId: integer("related_tool_id").notNull().references(() => toolsTable.id, { onDelete: "cascade" }),
   relationType: text("relation_type", { enum: ["similar", "replaces", "superseded_by", "recommended"] }).notNull().default("similar"),
   notes: text("notes"),
-  createdBy: integer("created_by").references(() => usersTable.id),
+  createdBy: integer("created_by").references(() => usersTable.id, { onDelete: "set null" }),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 });