Strip emoji from docs, fix XSS/hashing vulnerabilities, remediate all failing CI checks (#1)

* Initial plan

* Fix security vulnerabilities: MD5→SHA-256, XSS via dangerouslySetInnerHTML/innerHTML, insecure randomness, CodeQL config

Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com>

* Clean up README: remove decorative emojis for a professional tone

Remove all emojis from section headers, list item prefixes, and
decorative positions. Replace ✅ phase status markers with '(Complete)'
text. Keep the ⭐ in the final call-to-action line. No changes to
links, badges, code blocks, or technical content.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: remove emoji characters from CONTRIBUTING.md

Remove all emoji from section headers and closing line while
preserving links, code blocks, and technical content.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: remove emoji characters from documentation files

Remove all emoji characters from 8 documentation files in docs/.
Replace status-marker checkmarks (✅) with '(Done)' text.
Remove decorative emojis from headers and body text entirely.
Preserve emojis inside code blocks unchanged.
Clean up trailing whitespace introduced by removals.

Files modified:
- DEPLOYMENT_GUIDE.md
- IMPLEMENTATION_PLAN.md
- MILESTONE_6_SUMMARY.md
- PRODUCTION_ROADMAP.md
- PROJECT_STATUS.md
- REPOSITORY_ENHANCEMENT.md
- ROADMAP.md
- SECURITY_AUDIT_ROADMAP.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: remove emoji characters from documentation files

Remove all emoji characters from 9 markdown files while preserving
code block content (box-drawing characters, indentation). Emojis
removed from headers, list items, and body text across READMEs,
issue templates, PR template, runbook, and mobile docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove excessive emoji from all documentation for professional presentation

Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com>

* Fix PluginWidget initial state and remove || true from security audit steps

Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com>

* Remediate all failing CI checks: update deprecated actions, fix npm vulnerabilities, fix migrations YAML

Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com>

* Fix all remaining CI failures: Node 18→20, fix test API contract, fix pytest version, fix Postgres health checks

Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com>

docs/SECURITY.md

@@ -47,20 +47,20 @@ Key threats addressed:
 LifeRPG supports multiple secure authentication methods:
 
 1. **OAuth2/OIDC**: Integration with identity providers using PKCE
-   - Google, GitHub, Microsoft, etc.
-   - Authorization code flow with PKCE for SPAs and mobile
-   - Optional audience and issuer validation
-   - RP-initiated logout support
+ - Google, GitHub, Microsoft, etc.
+ - Authorization code flow with PKCE for SPAs and mobile
+ - Optional audience and issuer validation
+ - RP-initiated logout support
 
 2. **Two-Factor Authentication (2FA)**
-   - TOTP (Time-based One-Time Password)
-   - Recovery codes for backup access
-   - Session management with primary/alt sessions
+ - TOTP (Time-based One-Time Password)
+ - Recovery codes for backup access
+ - Session management with primary/alt sessions
 
 3. **API Tokens**
-   - Fine-grained permissions
-   - Expiring tokens with rotation
-   - Token revocation support
+ - Fine-grained permissions
+ - Expiring tokens with rotation
+ - Token revocation support
 
 ### Token Security
 
@@ -275,13 +275,13 @@ LifeRPG offers a bug bounty program with:
 ### Automated Testing
 
 - **SAST (Static Application Security Testing)**: Analyzes code for security issues
-  - Tools: Bandit, ESLint security plugins, CodeQL
+ - Tools: Bandit, ESLint security plugins, CodeQL
 - **DAST (Dynamic Application Security Testing)**: Tests running application
-  - Tools: OWASP ZAP, Burp Suite
+ - Tools: OWASP ZAP, Burp Suite
 - **Dependency Scanning**: Checks dependencies for vulnerabilities
-  - Tools: Dependabot, Snyk, OWASP Dependency Check
+ - Tools: Dependabot, Snyk, OWASP Dependency Check
 - **Container Scanning**: Analyzes container images
-  - Tools: Trivy, Clair
+ - Tools: Trivy, Clair
 
 ### Manual Testing