Reply to PR comment: concise feature summary for new-ui-features PR

[Copilot]

@LeeKrane requested a super concise description of the features introduced in the stacked PR (feat/new-ui-features).

Change

• Replied to comment 3981144742 with a bullet-point summary of the 7 key features added by the PR:
  • Supabase DB with AES-256-GCM client-side encrypted storage
  • Portfolio as single source of truth for applicant data
  • Resume CRUD (create, edit, duplicate, delete) with kind locking
  • ZIP export/import
  • AI resume generator from job descriptions via OpenAI
  • AI file import (PDF/DOCX/TXT → resume data)
  • Cover letter composable + PDF export

No code changes were made.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[LeeKrane]

@copilot elaborate on the used technologies (for example PBKDF2)

[Copilot]

@copilot elaborate on the used technologies (for example PBKDF2)

Technologies used in this PR:

Encryption (client-side, app/utils/crypto.ts + useEncryption.ts)

• Web Crypto API (crypto.subtle) — browser-native, no third-party crypto lib
• PBKDF2 (Password-Based Key Derivation Function 2) — derives a 256-bit AES key from user.id + a random 32-byte salt; 100,000 iterations with SHA-256 as the PRF
• AES-256-GCM — authenticated encryption for all applicant data stored in Supabase; each encryption call generates a fresh random 96-bit IV prepended to the ciphertext
• Salt is stored in profiles.encryption_key_salt; the derived key lives only in memory (Vue useState) and is cleared on logout

Database (supabase/migration-001-db-upgrade.sql)

• PostgreSQL via Supabase — new tables (certifications, portfolio_*), a resume_kind enum, indexes, and foreign-key constraints
• uuid-ossp extension for UUID primary keys
• Row-Level Security (RLS) policies on all user-owned tables

Schema validation

• Valibot (valibot) — lightweight runtime schema validation for all API request/response shapes and DB mapper output

AI (server/api/ai/)

• OpenAI SDK (openai npm package) server-side only, key never exposed to the client
• gpt-4.1-2025-04-14 — used for PDF parsing (vision API, pages sent as base64 PNG images) and resume draft generation
• gpt-4.1-mini — used for DOCX/TXT text extraction (cheaper, no vision needed)
• File parsing: PDF pages rendered as images client-side, DOCX text extracted with mammoth, TXT read directly

Framework

• Nuxt 3 with @nuxtjs/supabase module for SSR-safe auth and client injection