Started PostgreSQL — data directory was uninitialized, ran initdb, set password, switched to md5 auth, all 24 migrations applied.

Hardened db.ts — added statement_timeout: 30000, idle_in_transaction_session_timeout: 10000, created transaction() helper (BEGIN/COMMIT/ROLLBACK).
Multi-step API routes wrapped in transactions — Events POST, Conversations POST use atomic blocks.
Fixed leads pagination — status filter pushed into SQL WHERE (no client-side filtering after LIMIT/OFFSET), added SELECT COUNT(*) for total.
Rewrote dashboard — SQL aggregations (COUNT + GROUP BY + date_trunc) replace loading all leads into memory.
Optimized conversations GET — merged duplicate correlated subqueries into single LEFT JOIN LATERAL.
Created migration 021_performance_indexes.sql — 8 missing indexes + set_session_user_context() function caching current_user_hierarchy_level() as session variable (avoids per-query RLS join).
Fixed build error — duplicate const other in conversations route. Also fixed a TypeScript never error in dashboard breakdown map.
Verified — npx tsc --noEmit clean, npm test (13 pass, 7 integration skip gracefully), npx next build succeeds.

signaling-server.mjs

@@ -4,8 +4,11 @@ import { SignJWT, jwtVerify } from "jose"
 import pg from "pg"
 
 const PORT = process.env.SIGNALING_PORT || 3007
-const JWT_SECRET = new TextEncoder().encode(process.env.JWT_SECRET || "crm-envr-super-secret-key-2026")
-const DATABASE_URL = process.env.DATABASE_URL || "postgres://postgres:postgres@localhost:5432/crm"
+const rawSecret = process.env.JWT_SECRET
+if (!rawSecret) throw new Error("JWT_SECRET environment variable is required")
+const JWT_SECRET = new TextEncoder().encode(rawSecret)
+const DATABASE_URL = process.env.DATABASE_URL
+if (!DATABASE_URL) throw new Error("DATABASE_URL environment variable is required")
 
 const pool = new pg.Pool({ connectionString: DATABASE_URL })