Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login
- Admin sessions persisted (hashed tokens) so deploys no longer log the admin out
- Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event
- npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4)
- Untrack per-user data (study users/notes/progress/etc.) from git
- Dockerfile HEALTHCHECK; node --test suite for password hashing
- Fix email template cards remounting (lost input focus) on each keystroke
- Lint: 34 errors -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server/routes/study-account.js

@@ -21,6 +21,7 @@ import {
 import {
   requireStudyAuth,
   hashStudyPassword,
+  verifyStudyPassword,
   hashEmailChangeToken,
   normalizeStudyUsername,
   isValidStudyUsername,
@@ -173,10 +174,7 @@ export function register(app) {
     const currentPassword = typeof req.body?.currentPassword === 'string' ? req.body.currentPassword : ''
     const newPassword = typeof req.body?.newPassword === 'string' ? req.body.newPassword : ''
 
-    const currentHash = hashStudyPassword(currentPassword)
-    const a = Buffer.from(currentHash, 'utf8')
-    const b = Buffer.from(user.passwordHash, 'utf8')
-    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    if (!verifyStudyPassword(currentPassword, user.passwordHash)) {
       res.status(401).json({ message: 'Current password is incorrect.' })
       return
     }
@@ -378,10 +376,7 @@ export function register(app) {
       return
     }
 
-    const currentHash = hashStudyPassword(currentPassword)
-    const a = Buffer.from(currentHash, 'utf8')
-    const b = Buffer.from(user.passwordHash, 'utf8')
-    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    if (!verifyStudyPassword(currentPassword, user.passwordHash)) {
       res.status(401).json({ message: 'Current password is incorrect.' })
       return
     }