feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

backend/apps/accounts/serializers.py

@@ -0,0 +1,88 @@
+"""Serializers for registration, login and profile of the API's own users."""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from django.contrib.auth import password_validation
+from django.db import IntegrityError
+from rest_framework import serializers
+from rest_framework_simplejwt.serializers import (
+    TokenObtainPairSerializer as BaseTokenObtainPairSerializer,
+)
+
+from apps.accounts.models import Role, User
+
+audit = logging.getLogger("audit.auth")
+
+
+class UserSerializer(serializers.ModelSerializer):
+    can_view_pii = serializers.BooleanField(read_only=True)
+
+    class Meta:
+        model = User
+        fields = ("id", "email", "full_name", "role", "can_view_pii", "date_joined")
+        read_only_fields = fields
+
+
+class RegisterSerializer(serializers.ModelSerializer):
+    password = serializers.CharField(write_only=True, style={"input_type": "password"})
+    password_confirm = serializers.CharField(write_only=True, style={"input_type": "password"})
+
+    class Meta:
+        model = User
+        fields = ("email", "full_name", "password", "password_confirm")
+
+    def validate_email(self, value: str) -> str:
+        return value.strip().lower()
+
+    def validate_password(self, value: str) -> str:
+        # Runs Django's configured validators: length, common passwords, etc.
+        password_validation.validate_password(value)
+        return value
+
+    def validate(self, attrs: dict[str, Any]) -> dict[str, Any]:
+        if attrs["password"] != attrs["password_confirm"]:
+            raise serializers.ValidationError({"password_confirm": "Passwords do not match."})
+        return attrs
+
+    def create(self, validated_data: dict[str, Any]) -> User:
+        validated_data.pop("password_confirm")
+        password = validated_data.pop("password")
+        try:
+            # Self-service sign-up always yields the least privileged role;
+            # elevation is an explicit admin action.
+            return User.objects.create_user(password=password, role=Role.VIEWER, **validated_data)
+        except IntegrityError as exc:  # pragma: no cover - race with unique index
+            raise serializers.ValidationError(
+                {"email": "A user with this email already exists."}
+            ) from exc
+
+
+class TokenObtainPairSerializer(BaseTokenObtainPairSerializer):
+    """Adds identity claims to the access token and records an audit event."""
+
+    @classmethod
+    def get_token(cls, user: User):  # noqa: ANN206
+        token = super().get_token(user)
+        token["role"] = user.role
+        token["email"] = user.email
+        return token
+
+    def validate(self, attrs: dict[str, Any]) -> dict[str, Any]:
+        data = super().validate(attrs)
+        audit.info(
+            "login_succeeded",
+            extra={
+                "event": "login_succeeded",
+                "user_id": self.user.id,
+                "user_role": self.user.role,
+            },
+        )
+        data["user"] = UserSerializer(self.user).data
+        return data
+
+
+class LogoutSerializer(serializers.Serializer):
+    refresh = serializers.CharField()