Security
- HttpOnly session cookies, TLS in production.
- Sign-in is Google OAuth or a short-lived email OTP. No passwords are stored.
- Restaurant access checked server-side on every protected resource.
- Plan limits enforced in APIs, not only in the UI.
- Uploads restricted to images under 4MB.