Full architecture upgrade: Vercel Serverless + Engineering Quality Rules #3721 — ccantynz/hibiscus-to-airport

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/Hibiscus-to-airport/pull/26

Summary

Retire the FastAPI backend on Render — no more cold starts, no second system to monitor, no CORS headaches
Create complete Vercel Serverless API (/api/) — all endpoints migrated to Node.js serverless functions on the same domain
Fix 17 engineering gaps including critical security issues (password reset expiry, HTML injection in emails, non-idempotent Stripe webhooks)
Add The 10 Rules + 23 Engineering Quality Rules to CLAUDE.md — locked in permanently so every AI session follows them
Add public ErrorBoundary — no more white screens when a component crashes

Area	Before	After
Backend	FastAPI on Render (cold starts, separate deploy)	Vercel Serverless Functions (same domain, instant)
Database driver	asyncpg (connection pool, not serverless-friendly)	@neondatabase/serverless (HTTP-based, built for serverless)
Scheduled jobs	APScheduler (dies with backend)	Vercel Cron Jobs (reliable, managed)
Email templates	User input injected raw (HTML injection risk)	All user input HTML-escaped
Password reset	Token expiry never checked	Token expiry validated before reset
Stripe webhook	Could send duplicate emails	Idempotent — checks if already paid
Error handling	White screen on crash (public site)	ErrorBoundary with friendly fallback + refresh button
API responses	Inconsistent formats	Standardised `{ ok, data, error }`
Database	No indexes	Indexes on booking_ref, email, date, created_at, status, payment_status

api/lib/ — shared modules (db, auth, email, sms, pricing, helpers)
api/bookings.js — booking create + list
api/bookings/[ref].js — get/update/delete booking
api/bookings/[id]/ — cancel, resend-email, resend-sms, duplicate, update-status
api/admin/ — login, change-password, reset-password, bookings list
api/stripe/ — create-session, webhook, payment-status
api/drivers.js, api/promo.js, api/seo.js — supporting endpoints
api/cron/reminders.js — day-before reminder (Vercel Cron)
api/healthz.js, api/init-schema.js — operations
ENGINEERING_GAPS_REPORT.md — full audit of all identified issues