Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login
- Admin sessions persisted (hashed tokens) so deploys no longer log the admin out
- Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event
- npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4)
- Untrack per-user data (study users/notes/progress/etc.) from git
- Dockerfile HEALTHCHECK; node --test suite for password hashing
- Fix email template cards remounting (lost input focus) on each keystroke
- Lint: 34 errors -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test/study-password.test.js

@@ -0,0 +1,27 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import { hashStudyPassword, verifyStudyPassword, studyPasswordNeedsRehash } from '../server/study-helpers.js'
+
+test('new hashes are salted scrypt and verify', () => {
+  const a = hashStudyPassword('correct horse')
+  const b = hashStudyPassword('correct horse')
+  assert.match(a, /^scrypt\$[0-9a-f]+\$[0-9a-f]+$/)
+  assert.notEqual(a, b)
+  assert.ok(verifyStudyPassword('correct horse', a))
+  assert.ok(!verifyStudyPassword('wrong', a))
+  assert.ok(!studyPasswordNeedsRehash(a))
+})
+
+test('legacy SHA-256 hashes still verify and are flagged for rehash', () => {
+  const legacy = createHash('sha256').update('study-user:hunter2hunter2').digest('hex')
+  assert.ok(verifyStudyPassword('hunter2hunter2', legacy))
+  assert.ok(!verifyStudyPassword('nope', legacy))
+  assert.ok(studyPasswordNeedsRehash(legacy))
+})
+
+test('malformed stored values never verify', () => {
+  for (const bad of ['', undefined, null, 'scrypt$', 'scrypt$zz$', 'abc']) {
+    assert.ok(!verifyStudyPassword('x', bad))
+  }
+})