Harden architecture, accessibility, and security audit findings

[domucchi]

Summary

• tighten URL-derived username parsing to validate, dedupe, cap at 10, and ignore unsupported providers until dispatch exists
• add baseline security headers, metadataBase, and dev preview origin allowlist
• add shadcn-aligned dialog/toggle/progress/empty primitives and migrate matching UI controls to them
• fix mobile list/filter layout overflow and harden random-pick disabled link behavior
• update e2e coverage for view/mode controls and random-pick activation state
• correct stale docs around Next/Bun/provider-prefix behavior

Verification

• bun lint
• bun typecheck
• bun run format:check
• bun test
• bun run build
• bun test:e2e
• header probe confirmed X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
• Playwright screenshots captured for desktop results and mobile list layout

Notes for Reviewer

• Independent read-only subagent review passed after fixing disabled-link activation in the random-pick dialog.
• bun audit still reports transitive dev/build-tool advisories in eslint/shadcn/drizzle-kit/next dependency chains; compatible bun update did not resolve them, so no dependency bump was kept.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
whatnow-moe	Ready	Preview, Comment	Jul 1, 2026 8:14pm