Summary

This PR hardens the demo data path after the docs/analytics cleanup landed on main.

The app is still a flow-design prototype with a shared Convex demo database. Public write mutations made it possible for visitors to persist demo state changes into that shared backend, while the frontend already has a session-only overlay for visitor interactions. This change aligns the backend with that model: shared demo data remains read-only for visitors, and temporary interaction state stays local to the browser session.

What changed

• Removes public Convex write paths for visitor post creation and read-state updates.
• Keeps post/reply/read interactions in the existing session-only frontend overlay.
• Makes the destructive seed routine an internalMutation so it is not callable as a public function.
• Limits the main feed query to the latest 200 posts to avoid unbounded table scans during enrichment.
• Strips auth subject values from the public user directory response.
• Replaces client-supplied subject profile edits with an authenticated updateProfile mutation based on ctx.auth.getUserIdentity().
• Adds optional orgId to posts and simplifies org-scoped shared-space visibility checks.
• Deduplicates participants when merging backend posts with session-added reply participants.
• Adds CLEANUP_PLAN.md as the next-phase cleanup and architecture handoff.

User impact

Visitors can still explore the product flow, create local session posts/replies, mark content read, and use the prototype without mutating shared demo data. Authenticated profile edits are safer because the caller can only edit the profile associated with their own identity.

Validation

• Rebased onto latest origin/main after PR Clean docs and add Plausible tracking #2 merged.
• Ran bun install to hydrate the newly merged Plausible dependency locally.
• Ran bun run build successfully.

Summary by cubic

Locks down the demo backend to keep shared data read‑only, bounds feed reads, fixes org‑scoped visibility, and migrates auth to stable tokenIdentifier with automatic backfill from legacy subject (now via a shared helper).

• Bug Fixes & Hardening

  • Removed public write paths (convex/reads.ts, posts.create, posts.counts); visitor posts/replies/read state stay in the session overlay.
  • Made seed.run an internalMutation to prevent public DB wipes.
  • Replaced subject-based edits with users.updateProfile (uses ctx.auth.getUserIdentity(); no role edits); users.list no longer returns tokenIdentifier or subject.
  • Added users.by_token_identifier index and switched lookups; extracted authUsers.findUserForIdentity to resolve/backfill identities, used in users.updateProfile and discussions viewer creation; discussions now stores tokenIdentifier and derives avatar color from it.
  • Added optional posts.orgId and fixed org‑scoped visibility in spaces.feedForSpace.
  • Limited posts.feed to the latest 200 items.
  • Deduplicated participants when merging backend posts with session replies.
  • Updated convex/_generated/api.d.ts (added authUsers, removed reads) and added CLEANUP_PLAN.md.

• Migration

  • No UI changes; legacy users backfill automatically.
  • Update any callers to use users.updateProfile.
  • Regenerate convex/_generated/ with codegen when a deployment is available.

^{Written for commit b466066. Summary will update on new commits.}