feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

elk/logstash/pipeline/logstash.conf

@@ -0,0 +1,85 @@
+# =============================================================================
+# Application log pipeline.
+#
+# Django emits one JSON object per log record and ships it over TCP with
+# `python-logstash-async` (asynchronous, buffered - a Logstash outage never
+# blocks a request thread).  Because the payload is already structured there is
+# no grok parsing here: the pipeline only enriches, classifies and routes.
+# =============================================================================
+
+input {
+  tcp {
+    port  => 5959
+    codec => json_lines
+    tags  => ["django"]
+  }
+}
+
+filter {
+  # Fields Logstash adds itself and that carry no information for us.
+  mutate {
+    remove_field => ["port", "@version"]
+  }
+
+  # The application already stamps an ISO-8601 timestamp; trust it so the log
+  # line is filed under the moment it happened, not the moment it arrived.
+  date {
+    match  => ["@timestamp", "ISO8601"]
+    target => "@timestamp"
+    tag_on_failure => ["_timestamp_parse_failure"]
+  }
+
+  # Route by event type. `event` is set by the application through `extra=`.
+  if [event] == "search_executed" {
+    mutate { add_field => { "[@metadata][stream]" => "search" } }
+
+    # A slow search is worth alerting on; pre-computing the flag keeps the
+    # Kibana query simple.
+    if [took_ms] and [took_ms] > 500 {
+      mutate { add_tag => ["slow_search"] }
+    }
+    if [result_count] == 0 {
+      mutate { add_tag => ["zero_results"] }
+    }
+  } else if [event] in ["login_succeeded", "login_failed", "logout", "user_registered"] {
+    mutate { add_field => { "[@metadata][stream]" => "audit" } }
+  } else if [level] in ["ERROR", "CRITICAL"] {
+    mutate { add_field => { "[@metadata][stream]" => "error" } }
+  } else {
+    mutate { add_field => { "[@metadata][stream]" => "app" } }
+  }
+
+  # Never let a stray contact detail reach the log store.
+  mutate {
+    remove_field => ["password", "authorization", "emails", "phone_numbers"]
+  }
+}
+
+output {
+  elasticsearch {
+    # Credentials, when the cluster has security enabled, travel inside the
+    # URL (see docker-compose.prod.yml) so this single pipeline file works
+    # both with and without authentication.
+    hosts => ["${ELASTICSEARCH_HOSTS:http://elasticsearch:9200}"]
+
+    # One index per stream per day keeps retention policies simple and makes
+    # "delete everything older than 30 days" a single index deletion.
+    index => "app-logs-%{[@metadata][stream]}-%{+YYYY.MM.dd}"
+
+    # Composable index template (Elasticsearch 8 style): pins the types of the
+    # fields Kibana filters and aggregates on instead of letting dynamic
+    # mapping guess them.
+    manage_template    => true
+    template_api       => "composable"
+    template_name      => "app-logs"
+    template           => "/usr/share/logstash/templates/app-logs.json"
+    template_overwrite => true
+
+    action => "index"
+  }
+
+  # Anything that fails to parse is still visible in `docker compose logs`.
+  if "_jsonparsefailure" in [tags] or "_timestamp_parse_failure" in [tags] {
+    stdout { codec => rubydebug }
+  }
+}