feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

.env.example

@@ -0,0 +1,86 @@
+# =============================================================================
+# Copy to .env and adjust. Never commit the real .env.
+#   cp .env.example .env
+#
+# Generate a strong secret:
+#   python -c "import secrets; print(secrets.token_urlsafe(64))"
+# =============================================================================
+
+# --- Django ------------------------------------------------------------------
+DJANGO_SETTINGS_MODULE=config.settings.prod
+DJANGO_SECRET_KEY=change-me-to-a-64-character-random-string-before-any-real-deployment
+DJANGO_DEBUG=false
+DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,backend
+DJANGO_ADMIN_URL=admin/
+ENVIRONMENT=development
+SERVICE_NAME=linkedin-search-api
+SECURE_SSL_REDIRECT=false
+
+# The SPA is served from the same origin through nginx, so this list only
+# matters when you run `npm run dev` against the containerised API.
+CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:5173
+CSRF_TRUSTED_ORIGINS=http://localhost:8080,http://localhost:5173
+
+# --- PostgreSQL --------------------------------------------------------------
+POSTGRES_DB=linkedin
+POSTGRES_USER=linkedin
+POSTGRES_PASSWORD=change-me-postgres
+POSTGRES_HOST=postgres
+POSTGRES_PORT=5432
+
+# --- Redis (cache + throttling counters) -------------------------------------
+REDIS_URL=redis://redis:6379/1
+
+# --- JWT ---------------------------------------------------------------------
+JWT_ACCESS_MINUTES=15
+JWT_REFRESH_DAYS=7
+
+# --- Search ------------------------------------------------------------------
+# "elasticsearch" (default) or "postgres" to run without a cluster.
+SEARCH_BACKEND=elasticsearch
+ELASTICSEARCH_HOST=elasticsearch
+ELASTICSEARCH_PORT=9200
+ELASTICSEARCH_HOSTS=http://elasticsearch:9200
+ELASTICSEARCH_INDEX=linkedin-profiles
+ELASTICSEARCH_TIMEOUT=10
+# Only needed when the cluster has authentication enabled (docker-compose.prod.yml).
+ELASTIC_PASSWORD=change-me-elastic
+ELASTICSEARCH_USERNAME=
+ELASTICSEARCH_PASSWORD=
+
+# --- Logging / ELK -----------------------------------------------------------
+LOG_LEVEL=INFO
+LOGSTASH_ENABLED=true
+LOGSTASH_HOST=logstash
+LOGSTASH_PORT=5959
+
+# --- Rate limiting -----------------------------------------------------------
+THROTTLE_ANON=30/min
+THROTTLE_USER=300/min
+THROTTLE_SEARCH=120/min
+THROTTLE_LOGIN=10/min
+
+# --- Bootstrap ---------------------------------------------------------------
+# The API container imports the dataset and builds the index on first start.
+SEED_DATASET=true
+SEED_USERS=true
+RUN_MIGRATIONS=true
+DATASET_PATH=/data/linkedin_profiles.csv
+
+# Demo accounts created by `manage.py seed_users` (used by the README walkthrough).
+DEMO_ADMIN_EMAIL=admin@example.com
+DEMO_ADMIN_PASSWORD=Admin-Passw0rd!
+DEMO_ANALYST_EMAIL=analyst@example.com
+DEMO_ANALYST_PASSWORD=Analyst-Passw0rd!
+DEMO_VIEWER_EMAIL=viewer@example.com
+DEMO_VIEWER_PASSWORD=Viewer-Passw0rd!
+
+# --- Resource sizing ---------------------------------------------------------
+ES_JAVA_OPTS=-Xms512m -Xmx512m
+LS_JAVA_OPTS=-Xms256m -Xmx256m
+GUNICORN_WORKERS=3
+
+# --- Published ports ---------------------------------------------------------
+FRONTEND_PORT=8080
+BACKEND_PORT=8000
+KIBANA_PORT=5601