Modernize MichMoney: security fixes, uv/ruff/Vite, tests, CI

[rramboer]

Note: This PR targets this fork (rramboer/MichMoney), not the upstream SpartaHack repo.

⚠️ Action required after merge

Real secrets were committed to this repo's history: the Flask SECRET_KEY, three live admin API tokens, and real user accounts (emails + bcrypt hashes) in sql/data.sql and the tracked var/michmoney.sqlite3. This PR removes them from the tree, but they remain in git history — rotate them and treat the historical credentials as compromised.

Summary

Full modernization of this SpartaHack fintech app (structurally a sibling of WolvWealth) to current professional standards, preserving app behavior.

Security

• Admin API was fully unauthenticated: all 7 /api/admin/* and /api/db/* routes called check_admin_priv() but discarded the result. New fail-closed require_admin returns 403; db_dump no longer returns password hashes or raw token values
• SECRET_KEY now read from MICHMONEY_SECRET_KEY (dev-only fallback + rotation warning); seed data replaced with obviously-fake dev accounts
• CSRF tokens on all form POSTs; logout/delete POST-only; delete requires login
• A non-ASCII Authorization header or CSRF token used to raise TypeError inside hmac.compare_digest → HTTP 500; now rejected cleanly as 403/400 (with regression tests)
• Restored the MAX_CONTENT_LENGTH request-body cap; bin/run prod runs gunicorn on localhost instead of sudo flask --debug

Correctness

• add_admin/remove_admin 500'd on every request (phantom username params)
• Hardcoded UTC−5 replaced with DST-correct zoneinfo Eastern time (unit-tested EST vs EDT)
• Atomic token-use decrement; DB commits only on success; parse_universe no longer mutates the list it iterates
• Data paths resolved via pathlib; committed deterministic synthetic market data so /api/optimize works offline; dead/buggy yfinance code removed
• Choropleth.jsx no longer re-downloads its data every 5 seconds; broken redirect(redirect(...)) auth flows replaced with a shared login_required decorator

Tooling

• Python: hatchling + PEP 621 pyproject.toml, audited deps, uv.lock; ruff replaces pylint/black; frozen requirements.txt deleted
• Frontend: webpack+babel → Vite (same bundle path); pruned 17 unused deps (react-scripts, typosquat-suspect react-do, unused chart libs), added the genuinely-missing d3-scale, and used npm overrides to dedupe vulnerable transitives — npm audit: 0 vulnerabilities. Charting libs actually in use (d3, visx, react-simple-maps, chart.js) were verified by import audit and kept. ESLint 9 flat config with react-hooks
• Untracked the committed SQLite DB and build artifacts; removed a 24 MB orphaned hero image and dead data files; comprehensive .gitignore
• CI: Python job (uv, ruff check + format, pytest) and frontend job (npm ci, eslint, Vite build); Dependabot; MIT LICENSE; .editorconfig

Tests & docs

• 76 pytest cases, 85% coverage (was zero): auth flows, CSRF (including the non-ASCII case), admin 403 matrix, /api/account (including non-ASCII key), optimizer end-to-end, timezone units
• README rewritten with quickstart, scripts table, configuration + rotation warning, API docs, and project structure; the Devpost hackathon story is preserved

Verification

• Fresh uv install, ruff check/format --check, pytest (76/76), npm ci + lint + Vite build, npm audit (0) — all green
• App smoke-tested: DB rebuilt from seeds; GET / and /login/ → 200; auth-gated /forex/, /account/, /earnings-analyzer/ → 302; anonymous POST /api/db/dump/ → 403; bundle asset served; no 500s in the log