fix: apply code review findings — bugs, conventions, perf, security

[ChristopherRotnes]

Summary

Fixes 14 findings from a full codebase review covering correctness bugs, Carbon convention violations, performance improvements, and a security tightening. No new features or schema changes.

Changes

Bugs

• B1 — Report prefill weekday/sessionType discarded: clicking "Analyser periode" after saving a session now pre-selects the correct weekday chip and gym session type in the Report view (Report.jsx prefill useEffect)
• B2 — fetchGymSessionsByDate UTC range breaks DST: changed query bounds from +00:00 to +02:00 (Oslo CEST, worst-case offset) so all sessions on a Norwegian calendar day are returned regardless of DST transition (db.js)
• B3 — × remove-image button: replaced literal × character with Carbon <Close size={16} /> icon; fixed color: "#fff" → var(--cds-text-inverse) (MuscleMap.jsx)
• B4 — Blur timer leak on unmount: setTimeout in ExerciseRowWithAutocomplete now stored in a useRef and cancelled via useEffect cleanup

Convention violations

• getIntlLocale() centralised: added to utils.js as the single export; removed duplicate local definition in History.jsx and inline logic in Planlegger.jsx
• "no-NO" purged: MuscleMap.jsx, Bibliotek.jsx, TemplatePicker.jsx now call getIntlLocale() via Intl.DateTimeFormat
• date-fns locale removed: { locale: nb } usage eliminated from Home.jsx (formatSessionDate, formatTodayEyebrow) and Report.jsx (hover card date); replaced with Intl.DateTimeFormat
• Raw hex → semantic tokens:
  • getConfidenceColor #42be65/#f1c21b/#da1e28 → var(--heat-4) / var(--cds-support-warning) / var(--cds-support-error)
  • History calendar selection ring #ffffff → var(--cds-background)
  • Bibliotek secondary chip #78a9ff → var(--cds-blue-40)
  • MusclePicker focus stroke #0f62fe → var(--cds-interactive)
  • Report frequency table count #4589ff → var(--cds-blue-40)
• Gradients removed from Home.jsx: hero card background, decorative overlay div, and week-bar fill all replaced with solid tokens

Performance

• PERIODS, DAYS (Report) and STEP_DEFS (MuscleMap) wrapped in useMemo — were recreating arrays with t() calls on every render
• Planlegger.jsx projectedData: removed redundant calcMuscles(allExercises) call; primary/secondary Sets now derived directly from allExercises (one traversal instead of two)
• History.jsx edit mode: library exercises cached in a useRef; re-opening edit mode reuses the cached list instead of re-fetching

Security / robustness

• GET /api/sporty-health: removed full todaySessions array from response body; exposes count only
• claudeUtils.js: added comment documenting that rateLimitMap is per-instance and ephemeral (resets on cold start, not shared across Azure Function instances)

Docs

• CLAUDE.md: added getIntlLocale() to utils.js exports list; updated Report prefill docs; corrected sporty-health endpoint description
• README.md: added getIntlLocale to utils.js entry in project structure

Test plan

• cd app && npm test — all existing unit tests pass
• Upload a workout image → save session → click "Analyser periode" → Report opens with the session's weekday chip and gym session type pre-selected (B1)
• Switch language to English in Settings → verify all dates in History, TemplatePicker, Bibliotek, and Report render in English (C1/C2)
• Switch language to فارسی in Settings → same check + RTL layout correct (C1/C2)
• Toggle light theme in Settings → confidence dots in confirm step, History calendar selection ring, frequency table count colours, and secondary muscle chips in Bibliotek all render correctly (C3)
• Open Home screen → no gradients visible on hero card or week bar in either theme (C4)
• Open a session in History edit mode, close it, reopen → second open should not trigger a network request for library exercises (P3)
• Verify GET /api/sporty-health response no longer contains a todaySessions array (S1)

🤖 Generated with Claude Code

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://white-island-090dfd003-134.westeurope.7.azurestaticapps.net