Audit fixes: broken features, browser agent, security, performance, cleanup

.env.example

@@ -1,6 +1,10 @@
-# LLM backend: "groq" (cloud, default) or "ollama" (fully local)
+# LLM backend: "claude" (Anthropic), "groq" (cloud, compose default) or "ollama" (fully local)
 LLM_BACKEND=groq
 
+# Anthropic — required when LLM_BACKEND=claude
+# ANTHROPIC_API_KEY=
+# ANTHROPIC_MODEL=claude-sonnet-4-6
+
 # Groq API key — required when LLM_BACKEND=groq. Get one at https://console.groq.com
 GROQ_API_KEY=your_groq_api_key_here
 
@@ -10,10 +14,21 @@ GROQ_API_KEY=your_groq_api_key_here
 # OLLAMA_MODEL=qwen3.5:4b
 # EMBEDDING_MODEL=nomic-embed-text
 
+# JWT signing secret — REQUIRED. The API refuses to start without it.
+# Generate one with: openssl rand -hex 32
+JWT_SECRET=
+
+# Encryption key for stored job-site passwords — REQUIRED. Changing it makes saved passwords
+# unreadable (users just re-enter them). Generate one with:
+#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CREDENTIALS_KEY=
+
+# Brave Search API — optional, enables the Level 3 web-search job source. Free tier at https://brave.com/search/api
+BRAVE_SEARCH_API_KEY=
+
 # Adzuna Jobs API — optional, enables the Adzuna job source. Free tier at https://developer.adzuna.com
 ADZUNA_APP_ID=your_adzuna_app_id
 ADZUNA_API_KEY=your_adzuna_api_key
 
-# Job site login credentials for autonomous application (can also be set per-persona)
-JOB_EMAIL=your_email@example.com
-JOB_PASSWORD=your_password
+# Job-site login credentials are set per user on the Profile page (stored encrypted with
+# CREDENTIALS_KEY) — they are not configured here.

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  api:
+    name: API tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: api/requirements*.txt
+      - run: pip install -r requirements.txt -r requirements-dev.txt
+      - run: pytest
+
+  browser:
+    name: Browser-agent tests (headless Chromium)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: api/requirements*.txt
+      - run: pip install -r requirements.txt -r requirements-dev.txt
+      - run: python -m playwright install --with-deps chromium
+      - run: pytest -m browser
+
+  frontend:
+    name: Frontend type-check + build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci
+      - run: npx tsc --noEmit
+      - run: npm run build