Refactor monolithic modules and harden booking, email, and auth infrastructure.

Split oversized frontend API client, email service, and admin/booking pages into focused modules while preserving import surfaces, and add Redis-backed queues, stale booking cleanup, stronger auth, and scale deployment configs.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/routes/auth.ts

@@ -229,6 +229,21 @@ auth.post('/login', authRateLimit, zValidator('json', loginSchema), async (c) =>
   
   // Clear failed attempts on successful login
   clearFailedAttempts(data.email);
+
+  // Transparently upgrade legacy bcrypt hashes to argon2 now that we have the
+  // plaintext and have verified it. Best-effort: a failure here must not block
+  // the login.
+  if (!String(user.password).startsWith('$argon2')) {
+    try {
+      const upgradedHash = await hashPassword(data.password);
+      await (db as any)
+        .update(users)
+        .set({ password: upgradedHash })
+        .where(eq((users as any).id, user.id));
+    } catch (err: any) {
+      console.error('[auth] Failed to upgrade legacy password hash:', err?.message || err);
+    }
+  }
   
   const token = await createToken(user.id, user.email, user.role, user.tokenVersion ?? 0);
   const refreshToken = await createRefreshToken(user.id);