feat: backport production hardening and architecture improvements

[jeanpaulsio]

Summary

Backports battle-tested improvements discovered while using this starter template in production. Covers bug fixes, production hardening, DX improvements, and architectural refinements.

Bug Fixes (Priority 1)

• Fix validation error serialization — Pydantic ctx fields can contain non-JSON-serializable objects (ValueError instances), causing 500s on certain invalid inputs
• Add 30s PostgreSQL statement timeout — prevents runaway queries from exhausting the connection pool
• Fix access_token cookie TTL — was 24h on frontend but 30min on backend, causing silent auth failures

Production Hardening (Priority 2)

• Sentry error reporting in API client — captures 5xx errors (excluding 401s/auth endpoints) with status + URL tags
• Lower connection pool defaults — 10/20 was oversized for Render starter plan, now 5/5
• Redis via app.state — idiomatic FastAPI pattern instead of global variable in database.py
• Switch to slowapi — decorator-based rate limiting replaces custom Redis middleware

Architecture (Priority 3)

• Replace Zustand with React Query — useCurrentUser() + useLogout() hooks; server state belongs in React Query, not a client store
• Add query helpers — escape_like() for safe LIKE/ILIKE queries, parse_enum_filter() for comma-separated enum params
• Bump pagination max — 100 to 250

DX (Priority 4)

• CI parallelization — split backend into parallel lint + test jobs, add pip caching
• SSE streaming client — reusable streamSSE() utility for LLM/streaming endpoints
• Remove withCredentials — unnecessary with Bearer header auth pattern

Files Changed

• 30 files: 506 insertions, 396 deletions
• New: server/app/limiter.py, server/app/utils/query.py, web/hooks/useAuth.ts, web/lib/sse-client.ts
• Deleted: server/app/middleware/rate_limit.py, web/stores/auth-store.ts

Test plan

• Backend: cd server && ruff check app/ tests/ && ruff format --check app/ tests/ && mypy app/ --ignore-missing-imports && pytest tests/ -v
• Frontend: cd web && npm install && npm run lint && npm run typecheck && npm test
• Verify health endpoint still reports postgres + redis status
• Verify auth flow: register -> login -> dashboard -> logout
• Verify rate limiting on auth endpoints (5 rapid register attempts should 429)