Initial import: property management SaaS + security hardening + admin dashboard

Property Management Network — Next.js 16 (App Router), Better Auth,
Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend.

Includes:
- Security hardening: access-control/IDOR fixes, TLS-by-default DB layer,
  constant-time cron auth, strict security headers, atomic AI quota gating,
  HTML/email output encoding, demo-backdoor disabled in production.
- Superadmin dashboard at /admin (overview/MRR, server-paginated users with
  ban/impersonate/plan/delete, billing, platform activity + admin audit log,
  AI usage, system health) via the Better Auth admin plugin.
- Seed/migration utility scripts under scripts/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/hooks/use-user.ts

@@ -0,0 +1,54 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { useSession } from "@/lib/auth-client"
+import type { Profile } from "@/types"
+
+interface UserState {
+  user: { id: string; email: string; name?: string | null } | null
+  profile: Profile | null
+  loading: boolean
+}
+
+export function useUser(): UserState {
+  const { data: session, isPending } = useSession()
+  const [profile, setProfile] = useState<Profile | null>(null)
+  const [profileLoading, setProfileLoading] = useState(true)
+
+  const userId = session?.user?.id
+
+  useEffect(() => {
+    let active = true
+    if (!userId) {
+      setProfile(null)
+      setProfileLoading(false)
+      return
+    }
+    setProfileLoading(true)
+    fetch("/api/profile")
+      .then((r) => (r.ok ? r.json() : { profile: null }))
+      .then((data) => {
+        if (active) {
+          setProfile(data.profile ?? null)
+          setProfileLoading(false)
+        }
+      })
+      .catch(() => {
+        if (active) {
+          setProfile(null)
+          setProfileLoading(false)
+        }
+      })
+    return () => {
+      active = false
+    }
+  }, [userId])
+
+  return {
+    user: session?.user
+      ? { id: session.user.id, email: session.user.email, name: session.user.name }
+      : null,
+    profile,
+    loading: isPending || profileLoading,
+  }
+}

lib/hooks/use-warn-unsaved.ts

@@ -0,0 +1,18 @@
+"use client"
+
+import { useEffect } from "react"
+
+/**
+ * Adds a beforeunload warning when the form has unsaved changes.
+ * Pass `isDirty` — set to true as soon as any field changes.
+ */
+export function useWarnUnsaved(isDirty: boolean) {
+  useEffect(() => {
+    if (!isDirty) return
+    function handler(e: BeforeUnloadEvent) {
+      e.preventDefault()
+    }
+    window.addEventListener("beforeunload", handler)
+    return () => window.removeEventListener("beforeunload", handler)
+  }, [isDirty])
+}