Harden authentication and local development

[Luiscarranza13]

Summary

• harden JWT access/refresh lifecycle, cookie handling, session revocation, account checks, and production-safe errors
• add strict environment validation, graceful MongoDB/HTTP startup and shutdown, an admin seeder, a Docker-based MongoDB development workflow, ESLint, and operational documentation
• tighten school-data scopes and add API, CORS, cookie, authentication, validation, and configuration tests

Why

The existing backend required manual admin promotion and left several local and production behaviors implicit. This contribution makes those boundaries explicit and provides a repeatable local setup while preserving the original API domains.

Impact

• safer session rotation and logout behavior
• deterministic local setup and initial administrator creation
• clearer runtime failures and production responses
• repeatable typecheck, lint, build, and test workflow

Root causes addressed

• refresh-cookie configuration was duplicated across controllers
• runtime configuration and database readiness were not validated before listening
• authentication and session paths did not consistently reject blocked or inactive accounts
• the repository lacked maintained linting and meaningful application-level tests

Validation

• npm run typecheck
• npm run lint
• npm test ? 6/6 tests passing

Acknowledgement

Thank you, Hamid Karimi, for creating and open-sourcing SchoolOS Backend. Your work provided the foundation for these improvements. This contribution is offered with respect for your authorship and with the intention of giving value back to the community around the project.