list everything left open for the demo that must be closed before real users

docs/security-before-production.md records, item by item, what is exposed
on purpose while this is an internship demo: the committed token-signing key
still in use on the server, seven fixed-code demo logins, demo users in the
production database, a public /api/health that reports internal state, a
public API schema, a public leaderboard with children's names, /admin on the
public domain, the server answering on port 80 around ArvanCloud, per-worker
rate limits without Redis, guest login by deviceId alone, unhashed refresh
tokens and OTP codes, AI cost exposure through throwaway guests, hearts not
enforced, SQLite without off-box backups, and shared root access to the box.
Each has its risk, why it was left, the fix and how to verify it; the
exposure checks were run against the live server on 2026-09-25.

CLAUDE.md, README and docs/operations.md point to it so no agent mistakes
this deployment for production-ready.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -22,6 +22,15 @@ at checkout, `select_for_update` guards that SQLite silently ignores).
   race-free / the right architecture"; write "guards X; not tested under Y" instead.
   Record uncertainty plainly so the next reader re-checks rather than trusts.
 
+## Before any real user: read `docs/security-before-production.md`
+
+The server is deliberately left in demo mode for the internship presentation: the token
+signing key is the one committed in this repo, seven fixed-code demo logins exist, demo
+users sit in the production DB, and `/api/health`, the API schema, the leaderboard and
+`/admin/` are all public. Each is listed there with its risk, why it was left, and the
+fix. **Do not treat this deployment as production-ready until every item there is closed**,
+and record the date and commit of each fix in that file rather than deleting the item.
+
 ## Commands
 
 ```bash