Add GET /api/report/{username} wrapping audit_user_api_only(fast=True),
returning ApiOnlyReport.to_dict() JSON. Plain-def route offloads the
blocking, network-bound scan to FastAPI's threadpool; GitHubClient is
injected via a dependency for test/deploy override and server-side token.

- Validates the username via the existing validate_username gate (422).
- Maps GitHub errors: 404 not-found, 429 rate-limit (429 or 403 w/ zero
  quota), 403 forbidden, 502 for other HTTP/network/client errors.
- Clamps repos scored to MAX_REPOS_CAP to bound public cost.
- 14 endpoint tests; wired into the serve app factory.

Add CORSMiddleware to the app factory with origins resolved from
GHRA_CORS_ORIGINS (defaults to the local Next.js dev server). GET-only,
no credentials — the report endpoint is public and unauthenticated.

Add a Next.js 15 / React 19 App Router app under web/ that powers the
free hosted report: a username form does a client-side fetch to the
FastAPI /api/report endpoint and renders the result with a top-fixes
framing — grades, repo health, flags, and the engine's ranked action
candidates as the hero of each card. Repos sort worst-health-first.

- lib/api.ts: typed fetch client with per-status messages + a boundary
  shape guard; lib/url.ts: https-only href allowlist (XSS guard).
- ReportExplorer: client-side idle/loading/done/error state machine
  with ARIA live regions; ReportView + RepoCard are presentational.
- Dark editorial design, color-coded grade chips, mono accents.
- Typechecks clean, production build passes, visually verified end to
  end against a live GitHub user (8 cards rendered).

Add a pluggable hosting layer so the free report endpoint survives a
second visitor: an in-memory KV store (thread-safe, lazy-expiring, with
size-triggered reaping) backs a report cache (1h TTL default) and a
fixed-window per-IP rate limiter (20/hr default). A Redis/Upstash backend
drops in via GHRA_REDIS_URL for multi-instance deploys.

Endpoint flow is now throttle -> validate -> cache get/hit -> scan ->
cache put. Cache verified live: cold scan 6.3s, warm hit 1.5ms.

Hardening from review:
- Redis incr uses plain EXPIRE on first hit (no NX) — works on all server
  versions, never extends the window.
- X-Forwarded-For honored only when GHRA_TRUST_FORWARDED_FOR is set
  (default off) — XFF is spoofable, so default keys on the direct peer.
- Counter/value stores reap expired entries past a threshold to bound
  memory under unique-IP churn.

99 tests pass; ruff + mypy clean.

Load Space Grotesk (display/body) and JetBrains Mono (code/labels) via
next/font, replacing the system-ui stack with intentional, self-hosted
faces. Wired through the --font-sans / --font-mono CSS variables.

The report cache keys on username alone, but the endpoint accepted a
max_repos query param — a report cached for one cap could be served to a
request expecting another. Remove the public knob (MAX_REPOS_CAP already
bounds cost); the scan is always capped server-side, so a username fully
determines its cached report.

When the client has a token, list a user's repos via the existing
bulk_fetch_repos GraphQL query — one paginated call that also returns
per-repo language byte breakdowns, so metadata.languages is now populated
(REST left it empty). Falls back to REST list_repos when unauthenticated,
when GraphQL returns no user (clean 404), or on any GraphQL error.

Live-verified on octocat: language breakdowns populate, grades stable.

Step 4 — the 'earn the tier' instrumentation:

Backend:
- POST /api/waitlist captures emails (Pydantic-validated, throttled on a
  separate per-IP bucket so browsing reports never blocks signup).
- SqliteWaitlistStore: durable, dedup on lowercased email, thread-safe via
  lock + contextlib.closing per connection. Path from GHRA_WAITLIST_DB or
  under the app output dir.

Frontend:
- Shareable /u/[username] route: the form now routes there (via
  useTransition) instead of fetching in place, so every report has a URL.
- ReportLoader fetches client-side with an AbortController that cancels the
  orphaned scan on unmount/username change.
- WaitlistForm email capture on the report, with idle/submitting/done/error
  states; CORS now allows POST.

Verified live end to end: home → submit → /u/octocat → 8 cards → waitlist
signup persists with source attribution. 131 backend tests pass; web
typechecks + builds; reviewer findings from both stacks addressed.

Cold-scan latency was the gap (a 30-repo user took 60-90s, prolific users
timed out). Two changes:

- score_repos_api_only now materializes + analyzes + scores each repo
  concurrently (ThreadPoolExecutor, 8 workers). Safe on the hosted path: it
  is authenticated (ample rate limit), uses no shared response/analyzer
  cache, each repo writes its own temp subdir, and requests.Session is
  thread-safe. Scores are byte-identical to the sequential run.
- _select_repos ranks original active work (non-fork, non-archived) by
  recency then stars and takes the top N, so a prolific account's report
  showcases their best/current repos instead of an arbitrary slice. Cap
  lowered 30 -> 20.

Live: octocat 19.6s -> 6.3s; tiangolo (hundreds of repos) 90s+ timeout ->
18.7s scanning his top-20, all non-fork high-star repos.

Make the hosted report deployable:
- Dockerfile (uv, frozen lockfile, serve+hosting extras) running uvicorn
  with --forwarded-allow-ips so the per-IP throttle sees real client IPs
  behind a proxy. Built + ran the image: /api/health returns 200.
- fly.toml: health check on /api/health, /data volume for the waitlist DB,
  non-secret config; secrets via fly secrets set.
- .dockerignore trims the context to pyproject/uv.lock + src.
- DEPLOY.md: full runbook (Fly API, Vercel frontend, Upstash Redis, env
  reference, Postgres follow-up).
- Add GET /api/health (reports token presence) for platform probes.
- uv.lock now includes the redis (hosting) extra.

Fix found via the container run: SqliteWaitlistStore now creates its parent
dir so it works on a fresh host before the volume path is populated.