feat(prod): production deployment fixes - env loader, mongoose module, CSS static files, security hardening, PDF export, new UI components

backend/routes/auth/helpers.js

@@ -50,7 +50,24 @@ const storage = multer.diskStorage({
     cb(null, `profile-${uniqueSuffix}${path.extname(file.originalname)}`);
   }
 });
-const upload = multer({ storage });
+
+// File filter — only allow image formats for profile picture uploads
+function imageFileFilter(req, file, cb) {
+  const allowedMimeTypes = ['image/jpeg', 'image/jpg', 'image/png', 'image/webp'];
+  if (allowedMimeTypes.includes(file.mimetype)) {
+    cb(null, true);
+  } else {
+    cb(new Error('Invalid file type. Only JPEG, PNG, and WebP images are allowed.'), false);
+  }
+}
+
+const upload = multer({
+  storage,
+  fileFilter: imageFileFilter,
+  limits: {
+    fileSize: 5 * 1024 * 1024, // 5 MB maximum per profile picture
+  },
+});
 
 module.exports = {
   JWT_SECRET,