Address code review comments: security, performance, and bug fixes

[Copilot]

Addresses 10 review comments from PR #912 covering security vulnerabilities, performance bottlenecks, and runtime bugs.

Security

• Truncate auth tokens in logs to prevent exposure (optionalAuth middleware now logs Bearer eyJhbGc...xyz instead of full token)
• Add validation requiring authenticated user before creating tax_id records (removes @ts-ignore, adds 401 response)
• Document localStorage XSS vulnerability with mitigation recommendations

Performance

• Replace listUsers() scan with direct profile table query in checkUserExists() (O(1) vs O(n))
• Use PostgreSQL <12 compatible enum value check via pg_enum table

Bug Fixes

• Fix infinite loop: use useRef to track session restoration instead of isAuthenticated dependency
• Fix handleUrlTokens() returning incomplete AuthTokens object with empty user_id
• Fix form submission breaking Enter key: change button to type="submit" with form id reference
• Use sentinel UUID 00000000-0000-0000-0000-000000000001 for migration placeholder instead of random UUID

UX

• Increase email OTP rate limit from 2 to 10 per hour

Example of the auth validation fix:

// Before: creates record with potentially undefined userId
await TaxId.create({
  // @ts-ignore
  userId: req.userId  // may be undefined with optionalAuth
});

// After: validates authentication requirement
if (!req.userId) {
  res.status(401).json({ error: "Authentication required" });
  return;
}
await TaxId.create({ userId: req.userId });  // type-safe

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[netlify]

✅ Deploy Preview for vortex-sandbox ready!

Name	Link
🔨 Latest commit	ca868ef
🔍 Latest deploy log	https://app.netlify.com/projects/vortex-sandbox/deploys/694112b7edbc390008ab63ec
😎 Deploy Preview	https://deploy-preview-969--vortex-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.