feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

backend/config/settings/prod.py

@@ -0,0 +1,42 @@
+"""
+Production settings.
+
+Everything that can be hardened is hardened here; the module intentionally
+fails loudly on start-up when a required secret is missing rather than falling
+back to an insecure default.
+"""
+
+from .base import *  # noqa: F403
+from .base import DEBUG, SECRET_KEY, env
+
+# ---------------------------------------------------------------------------
+# Fail fast on unsafe configuration
+# ---------------------------------------------------------------------------
+if DEBUG:  # pragma: no cover - configuration guard
+    raise RuntimeError("DJANGO_DEBUG must be false when using production settings.")
+
+if len(SECRET_KEY) < 50:  # pragma: no cover - configuration guard
+    raise RuntimeError("DJANGO_SECRET_KEY must be at least 50 characters in production.")
+
+# ---------------------------------------------------------------------------
+# Transport security
+# ---------------------------------------------------------------------------
+SECURE_SSL_REDIRECT = env.bool("SECURE_SSL_REDIRECT", default=True)
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+SECURE_HSTS_SECONDS = 31_536_000  # one year
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_SAMESITE = "Strict"
+CSRF_COOKIE_SAMESITE = "Strict"
+
+# ---------------------------------------------------------------------------
+# Misc hardening
+# ---------------------------------------------------------------------------
+# Admin lives behind an unguessable prefix so credential stuffing bots miss it.
+ADMIN_URL = env("DJANGO_ADMIN_URL", default="admin/")
+
+# Deny by default; CORS_ALLOWED_ORIGINS must be set explicitly.
+CORS_ALLOW_ALL_ORIGINS = False