Auto-sync .kiro/ from master (post-checkout hook)

.kiro/steering/tech.md

@@ -5,31 +5,48 @@
 | Layer | Technology |
 |-------|-----------|
 | Backend | Node.js 18+, Express 5 |
-| Database | SQLite3 (file: `backend/cve_database.db`) |
+| Database | PostgreSQL (via `pg` pool in `backend/db.js`) |
 | Auth | bcryptjs, cookie-based sessions (httpOnly, 24h expiry) |
 | File uploads | Multer 2 (10MB limit) |
 | Frontend | React 19 (Create React App / react-scripts 5) |
+| Frontend serving | Express serves `frontend/build/` as static files on port 3001 |
 | UI Icons | lucide-react |
 | Charts | recharts |
 | Spreadsheet parsing | xlsx (frontend), pandas + openpyxl (backend Python scripts) |
 | Markdown rendering | react-markdown |
 | Diagrams | mermaid |
 
+## Architecture: Single-Port Serving
+
+Express on port 3001 serves **both** the API and the production frontend build:
+- API routes: `/api/*` — handled by Express route handlers
+- Frontend: everything else — served as static files from `frontend/build/`
+
+There is no separate frontend server in production. The React dev server (`npm start` on port 3000) is only for local development with hot-reload. In production and on the dev server, you must run `npm run build` in `frontend/` after any frontend code change, then restart the backend.
+
+**After editing frontend source files:**
+```bash
+cd frontend && npm run build    # Compile new bundle into frontend/build/
+# Then restart backend (or it will serve the new static files on next request)
+```
+
+The CI/CD pipeline handles this automatically — `build-frontend` stage runs before deploy.
+
 ## Common Commands
 
 ### Backend
 ```bash
 cd backend
 node setup.js          # Initialize DB, tables, indexes, default admin user
-node server.js         # Start backend on port 3001
+node server.js         # Start backend on port 3001 (serves API + frontend build)
 ```
 
 ### Frontend
 ```bash
 cd frontend
 npm install            # Install dependencies
-npm start              # Dev server on port 3000
-npm run build          # Production build
+npm run build          # Production build → frontend/build/ (REQUIRED after code changes)
+npm start              # Dev server on port 3000 (local dev only, NOT used in production)
 npm test               # Run tests (react-scripts test)
 ```
 
@@ -39,16 +56,9 @@ npm test               # Run tests (react-scripts test)
 ./stop-servers.sh      # Stop all servers
 ```
 
-### Database Migrations (run from `backend/` in order)
+### Database Migrations (run from `backend/`)
 ```bash
-node migrations/add_knowledge_base_table.js
-node migrations/add_archer_tickets_table.js
-node migrations/add_ivanti_sync_table.js
-node migrations/add_ivanti_findings_tables.js
-node migrations/add_ivanti_todo_queue_table.js
-node migrations/add_card_workflow_type.js
-node migrations/add_todo_queue_ip_address.js
-node migrations/add_compliance_tables.js
+node migrations/run-all.js    # Runs all migrations in order (idempotent)
 ```
 
 ### Python Scripts (from `backend/scripts/`)
@@ -68,11 +78,11 @@ Python dependencies: `pandas>=2.0.0`, `openpyxl>=3.0.0` (install via apt or venv
 - `backend/.env` — PORT, CORS_ORIGINS, SESSION_SECRET, NVD_API_KEY, Ivanti API credentials
 - `frontend/.env` — REACT_APP_API_BASE, REACT_APP_API_HOST
 - Both `.env` files are gitignored; see `.env.example` files for templates.
-- React caches env vars at build/start time — restart the frontend process after changes.
+- React env vars are baked in at **build time** — you must rebuild (`npm run build`) after changing them.
 
-## Default Ports
+## Ports
 
-| Service | URL |
-|---------|-----|
-| Frontend | http://localhost:3000 |
-| Backend API | http://localhost:3001 |
+| Environment | URL | Notes |
+|---|---|---|
+| Production / Dev server | http://IP:3001 | Express serves API + static frontend build |
+| Local dev (frontend only) | http://localhost:3000 | React dev server with hot-reload, proxies API to :3001 |