feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

backend/apps/accounts/views.py

@@ -0,0 +1,85 @@
+"""Authentication endpoints: register, login, refresh, logout, me."""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+
+from drf_spectacular.utils import extend_schema
+from rest_framework import generics, status
+from rest_framework.permissions import AllowAny, IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+from rest_framework_simplejwt.exceptions import TokenError
+from rest_framework_simplejwt.tokens import RefreshToken
+from rest_framework_simplejwt.views import TokenObtainPairView as BaseTokenObtainPairView
+from rest_framework_simplejwt.views import TokenRefreshView as BaseTokenRefreshView
+
+from apps.accounts.models import User
+from apps.accounts.serializers import LogoutSerializer, RegisterSerializer, UserSerializer
+from apps.core.throttling import LoginRateThrottle
+
+audit = logging.getLogger("audit.auth")
+
+
+@extend_schema(tags=["auth"])
+class RegisterView(generics.CreateAPIView):
+    """Self-service sign-up. New accounts always get the ``viewer`` role."""
+
+    serializer_class = RegisterSerializer
+    permission_classes = [AllowAny]
+    throttle_classes = [LoginRateThrottle]
+    queryset = User.objects.all()
+
+    def create(self, request: Request, *args, **kwargs) -> Response:
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        user = serializer.save()
+        audit.info("user_registered", extra={"event": "user_registered", "user_id": user.id})
+        return Response(UserSerializer(user).data, status=status.HTTP_201_CREATED)
+
+
+@extend_schema(tags=["auth"])
+class LoginView(BaseTokenObtainPairView):
+    """Exchange credentials for an access/refresh token pair."""
+
+    permission_classes = [AllowAny]
+    throttle_classes = [LoginRateThrottle]
+
+
+@extend_schema(tags=["auth"])
+class RefreshView(BaseTokenRefreshView):
+    """Rotate a refresh token; the presented token is blacklisted afterwards."""
+
+    permission_classes = [AllowAny]
+    throttle_classes = [LoginRateThrottle]
+
+
+@extend_schema(tags=["auth"], request=LogoutSerializer, responses={205: None})
+class LogoutView(APIView):
+    """Blacklist a refresh token so it can no longer be rotated."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = LogoutSerializer
+
+    def post(self, request: Request) -> Response:
+        serializer = LogoutSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        # An already-invalid token is not an error worth surfacing: the
+        # caller's intent (be logged out) is satisfied either way.
+        with contextlib.suppress(TokenError):
+            RefreshToken(serializer.validated_data["refresh"]).blacklist()
+        audit.info("logout", extra={"event": "logout", "user_id": request.user.id})
+        return Response(status=status.HTTP_205_RESET_CONTENT)
+
+
+@extend_schema(tags=["auth"])
+class MeView(generics.RetrieveAPIView):
+    """Identity and effective privileges of the calling user."""
+
+    serializer_class = UserSerializer
+    permission_classes = [IsAuthenticated]
+
+    def get_object(self) -> User:
+        return self.request.user