feat: implement Phase 1 hardening

- Verify JWT signatures via JWKS in auth.py
- Fix broken frontend auth button references
- Add Pydantic Settings for env validation (RETENTION_DAYS, CORS_ORIGINS)
- Create MongoDB indexes + TTL on startup
- Add /health endpoint and CORS middleware
- Escape regex input in event queries
- Fix dedupe() return calculation in maintenance.py
- Replace basic logging with structured structlog JSON logs
- Update README and add ROADMAP.md

backend/maintenance.py

@@ -79,7 +79,8 @@ def dedupe(limit: int = None, batch_size: int = 500) -> int:
     if to_delete:
         events_collection.delete_many({"_id": {"$in": to_delete}})
 
-    return len(seen) - processed if processed > len(seen) else 0
+    removed = processed - len(seen)
+    return removed if removed > 0 else 0
 
 
 def main():