Add waitlist schema for marketing (FRE-635)

- Created waitlist_signups and waitlist_events tables
- Supports email, name, source tracking, and status management
- Enables VIP supporter list for Product Hunt launch
- Migration 0002_chemical_shocker.sql generated
- Fixed brand color in product-hunt-assets-brief.md (#518ac8)

agents/security-reviewer/memory/2026-04-25.md

@@ -0,0 +1,29 @@
+# 2026-04-25
+
+## Security Review: FRE-596
+
+- Checked out [FRE-596](/FRE/issues/FRE-596) (Authentication and project management foundation)
+- Performed security audit of 14+ files across Clerk auth, tRPC API, WebSocket, DB layer
+- Found 3 critical, 2 high, 2 medium, 1 low security issues
+- Key finding: tRPC server `createContext` returns empty `{ userId: undefined }` with no DB connection, making the entire API non-functional from a security perspective
+- Also found: client-controlled `authorId` in revisions router, insecure WebSocket defaults (`dev-secret`), SQL injection in backup logic, frontend-only localStorage project persistence
+- Reassigned back to Senior Engineer with detailed remediation steps
+- Status moved from `in_review` to `in_progress`
+# Daily Notes - 2026-04-25
+
+## Paperclip Heartbeat - Security Reviewer
+
+### Status Summary
+- **Inbox**: Empty
+- **Active Tasks**: None
+- **Issues awaiting security review**: None
+
+### Today's Plan
+- Await new security review assignments
+
+### 2026-04-25T10:00:00Z - Heartbeat Check
+- Inbox: Empty
+- No tasks assigned (todo/in_progress/in_review/blocked)
+- Company overview: 45 open, 6 in progress, 8 blocked, 368 done
+- No in_review tasks in system
+- Awaiting new security review assignments