Reconciles onboarding_configs.schema_json (previously orphaned seed data
using a field vocabulary that didn't match production) with the live
profile-fields-config.ts field keys, and extends the schema with
lockAfterApproval flags, step types, and a per-role portfolioModel so
the frontend wizard is entirely schema-driven rather than hardcoded per
role.
Also: closes an unauthenticated write on the onboarding/dashboard
config create endpoints (require_admin was missing), and adds
server-side enforcement in save_profile rejecting changes to any field
marked lockAfterApproval once a profile is APPROVED — the UI already
disables these inputs, this stops a direct API call from bypassing it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add crates/cache with client, otp, rate_limit, token, lead, jobs modules
- OTP tokens stored in Redis (15-min TTL, single-use GETDEL on verify)
- Refresh tokens stored in Redis (30-day TTL) — removed DB storage
- Password reset tokens stored in Redis (1-hour TTL, single-use)
- Rate limiting: register (10/hr), login (10/15min), OTP resend (3/hr), lead (5/hr), job post (20/hr)
- Lead request deduplication: 24-hour Redis lock per professional+requirement pair
- Marketplace listings cached in Redis (5-min TTL per profession+page+limit)
- Add ProfessionState{pool, redis} to contracts crate, replacing bare PgPool in all 9 profession apps
- All profession handlers and main.rs updated to use ProfessionState
- REDIS_URL env var (default: redis://127.0.0.1:6379) used across all services
- Fix profession model struct name mangling in 6 handlers (MakeupArtistRepository etc.)
- Add custom_data JSONB migration for all 9 profession profile tables
- Add onboarding_state model and repository (save_progress, complete, is_complete)
- Add onboarding handler accepting roleKey:String (not role_id:UUID) for frontend compat
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
