feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

frontend/src/api/client.ts

@@ -0,0 +1,121 @@
+/**
+ * Axios instance shared by the whole app.
+ *
+ * Responsibilities:
+ *  - prefix every call with the API base URL;
+ *  - attach the bearer token;
+ *  - transparently refresh an expired access token exactly once per failure,
+ *    queueing any parallel requests so a burst of 401s triggers one refresh;
+ *  - normalise the backend's error envelope into a plain `Error`.
+ *
+ * Tokens live in `sessionStorage`: they disappear when the tab is closed, and
+ * unlike a cookie they are never attached to cross-site requests, so the API
+ * needs no CSRF protection for its JSON endpoints.
+ */
+import axios, { AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
+
+import type { ApiError } from '@/types';
+
+const BASE_URL = import.meta.env.VITE_API_BASE_URL ?? '/api/v1';
+const ACCESS_KEY = 'lks.access';
+const REFRESH_KEY = 'lks.refresh';
+
+export const tokenStore = {
+  get access(): string | null {
+    return sessionStorage.getItem(ACCESS_KEY);
+  },
+  get refresh(): string | null {
+    return sessionStorage.getItem(REFRESH_KEY);
+  },
+  save(access: string, refresh?: string): void {
+    sessionStorage.setItem(ACCESS_KEY, access);
+    if (refresh) sessionStorage.setItem(REFRESH_KEY, refresh);
+  },
+  clear(): void {
+    sessionStorage.removeItem(ACCESS_KEY);
+    sessionStorage.removeItem(REFRESH_KEY);
+  },
+};
+
+export const api: AxiosInstance = axios.create({
+  baseURL: BASE_URL,
+  timeout: 15000,
+  headers: { 'Content-Type': 'application/json' },
+});
+
+api.interceptors.request.use((config: InternalAxiosRequestConfig) => {
+  const token = tokenStore.access;
+  if (token) config.headers.Authorization = `Bearer ${token}`;
+  return config;
+});
+
+type Waiter = (token: string | null) => void;
+let refreshing = false;
+let waiters: Waiter[] = [];
+
+function notify(token: string | null): void {
+  waiters.forEach((resolve) => resolve(token));
+  waiters = [];
+}
+
+async function refreshAccessToken(): Promise<string | null> {
+  const refresh = tokenStore.refresh;
+  if (!refresh) return null;
+  try {
+    const { data } = await axios.post<{ access: string; refresh?: string }>(
+      `${BASE_URL}/auth/refresh/`,
+      { refresh },
+      { headers: { 'Content-Type': 'application/json' } },
+    );
+    tokenStore.save(data.access, data.refresh);
+    return data.access;
+  } catch {
+    tokenStore.clear();
+    return null;
+  }
+}
+
+api.interceptors.response.use(
+  (response) => response,
+  async (error: AxiosError<ApiError>) => {
+    const original = error.config as (InternalAxiosRequestConfig & { _retried?: boolean }) | undefined;
+
+    if (error.response?.status === 401 && original && !original._retried) {
+      original._retried = true;
+
+      if (refreshing) {
+        const token = await new Promise<string | null>((resolve) => waiters.push(resolve));
+        if (!token) return Promise.reject(toError(error));
+        original.headers.Authorization = `Bearer ${token}`;
+        return api(original);
+      }
+
+      refreshing = true;
+      const token = await refreshAccessToken();
+      refreshing = false;
+      notify(token);
+
+      if (token) {
+        original.headers.Authorization = `Bearer ${token}`;
+        return api(original);
+      }
+      window.dispatchEvent(new CustomEvent('auth:expired'));
+    }
+
+    return Promise.reject(toError(error));
+  },
+);
+
+export function toError(error: unknown): Error {
+  if (axios.isAxiosError<ApiError>(error)) {
+    const payload = error.response?.data;
+    if (payload?.error) {
+      const enriched = new Error(payload.error.message);
+      enriched.name = payload.error.code;
+      return enriched;
+    }
+    if (error.code === 'ECONNABORTED') return new Error('The request timed out. Please retry.');
+    return new Error(error.message);
+  }
+  return error instanceof Error ? error : new Error('Unexpected error');
+}