Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/api/projects/[id]/route.ts

@@ -0,0 +1,197 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, isDatabaseAvailable } from "@/lib/db";
+import { ensureDatabaseInitialized } from "@/lib/db/init";
+import { projects } from "@/lib/schema/db";
+import { eq, and } from "drizzle-orm";
+import { getCurrentUser } from "@/lib/auth/session";
+import { requireCsrf } from "@/lib/auth/csrf";
+import { sanitizeText } from "@/lib/ingest/sanitize";
+import { isProActive } from "@/lib/billing/access";
+import {
+  resolveGuestContext,
+  applyGuestCookie,
+  type GuestContext,
+} from "@/lib/auth/guest";
+
+export const runtime = "nodejs";
+
+const PROJECT_NAME_MAX_LENGTH = 120;
+const PROJECT_COLORS = ["slate", "blue", "emerald", "amber", "rose", "violet"];
+
+async function resolveScope(req: NextRequest): Promise<{
+  user: Awaited<ReturnType<typeof getCurrentUser>>;
+  userId: string;
+  guest: GuestContext | null;
+}> {
+  const user = await getCurrentUser();
+  if (user) return { user, userId: user.id, guest: null };
+
+  const guest = resolveGuestContext(req);
+  return { user: null, userId: guest.bucket, guest };
+}
+
+function isProUser(user: Awaited<ReturnType<typeof getCurrentUser>>): boolean {
+  return isProActive(user);
+}
+
+/** GET /api/projects/[id] — single project, ownership-checked, left ungated like the list endpoint. */
+export async function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params;
+    const dbAvailable = await isDatabaseAvailable();
+    if (!dbAvailable) {
+      return NextResponse.json({ error: "Database unavailable." }, { status: 503 });
+    }
+
+    await ensureDatabaseInitialized();
+    const scope = await resolveScope(req);
+
+    const rows = await db
+      .select()
+      .from(projects)
+      .where(and(eq(projects.id, id), eq(projects.userId, scope.userId)))
+      .limit(1);
+
+    if (rows.length === 0) {
+      return applyGuestCookie(
+        NextResponse.json({ error: "Project not found." }, { status: 404 }),
+        scope.guest
+      );
+    }
+
+    const p = rows[0];
+    return applyGuestCookie(
+      NextResponse.json({
+        success: true,
+        project: {
+          id: p.id,
+          name: p.name,
+          color: p.color,
+          createdAt: p.createdAt.toISOString(),
+          updatedAt: p.updatedAt.toISOString(),
+        },
+      }),
+      scope.guest
+    );
+  } catch (error: any) {
+    console.error("GET /api/projects/[id] error:", error);
+    return NextResponse.json({ error: "Failed to load project." }, { status: 500 });
+  }
+}
+
+/** PATCH /api/projects/[id] — rename / recolor. Pro-only, ownership-checked. */
+export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const csrfBlocked = requireCsrf(req);
+    if (csrfBlocked) return csrfBlocked;
+
+    const { id } = await params;
+    const dbAvailable = await isDatabaseAvailable();
+    if (!dbAvailable) {
+      return NextResponse.json({ error: "Database unavailable." }, { status: 503 });
+    }
+
+    await ensureDatabaseInitialized();
+    const scope = await resolveScope(req);
+
+    if (!isProUser(scope.user)) {
+      return NextResponse.json({ error: "pro_required" }, { status: 402 });
+    }
+
+    const existing = await db
+      .select({ id: projects.id })
+      .from(projects)
+      .where(and(eq(projects.id, id), eq(projects.userId, scope.userId)))
+      .limit(1);
+    if (existing.length === 0) {
+      return applyGuestCookie(
+        NextResponse.json({ error: "Project not found." }, { status: 404 }),
+        scope.guest
+      );
+    }
+
+    const body = await req.json().catch(() => null);
+    const updates: { name?: string; color?: string | null; updatedAt: Date } = {
+      updatedAt: new Date(),
+    };
+    if (typeof body?.name === "string") {
+      const name = sanitizeText(body.name, PROJECT_NAME_MAX_LENGTH);
+      if (!name) {
+        return NextResponse.json({ error: "Project name is required." }, { status: 400 });
+      }
+      updates.name = name;
+    }
+    if (body?.color !== undefined) {
+      updates.color = PROJECT_COLORS.includes(body.color) ? body.color : null;
+    }
+
+    const [updated] = await db
+      .update(projects)
+      .set(updates)
+      .where(eq(projects.id, id))
+      .returning();
+
+    return applyGuestCookie(
+      NextResponse.json({
+        success: true,
+        project: {
+          id: updated.id,
+          name: updated.name,
+          color: updated.color,
+          createdAt: updated.createdAt.toISOString(),
+          updatedAt: updated.updatedAt.toISOString(),
+        },
+      }),
+      scope.guest
+    );
+  } catch (error: any) {
+    if (error?.code === "23505") {
+      return NextResponse.json(
+        { error: "A project with this name already exists." },
+        { status: 409 }
+      );
+    }
+    console.error("PATCH /api/projects/[id] error:", error);
+    return NextResponse.json({ error: "Failed to update project." }, { status: 500 });
+  }
+}
+
+/** DELETE /api/projects/[id] — Pro-only, ownership-checked. Receipts detach via ON DELETE SET NULL. */
+export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const csrfBlocked = requireCsrf(req);
+    if (csrfBlocked) return csrfBlocked;
+
+    const { id } = await params;
+    const dbAvailable = await isDatabaseAvailable();
+    if (!dbAvailable) {
+      return NextResponse.json({ error: "Database unavailable." }, { status: 503 });
+    }
+
+    await ensureDatabaseInitialized();
+    const scope = await resolveScope(req);
+
+    if (!isProUser(scope.user)) {
+      return NextResponse.json({ error: "pro_required" }, { status: 402 });
+    }
+
+    const existing = await db
+      .select({ id: projects.id })
+      .from(projects)
+      .where(and(eq(projects.id, id), eq(projects.userId, scope.userId)))
+      .limit(1);
+    if (existing.length === 0) {
+      return applyGuestCookie(
+        NextResponse.json({ error: "Project not found." }, { status: 404 }),
+        scope.guest
+      );
+    }
+
+    await db.delete(projects).where(eq(projects.id, id));
+
+    return applyGuestCookie(NextResponse.json({ success: true }), scope.guest);
+  } catch (error: any) {
+    console.error("DELETE /api/projects/[id] error:", error);
+    return NextResponse.json({ error: "Failed to delete project." }, { status: 500 });
+  }
+}