[SURYANSH-RAI]

Bug fixes: complete R04 match ranking, fix login test isolation

This branch is based on R01 (109a751) and fixes the two problems found in a full check of the platform (typecheck, lint, tests, build, migrations, and a run of the app).

1. bug fixx-incomplete-r04-match-rank

The R04 change (save the final match order) was only partly in place. The ports and the rerank and persist steps expected rank and computation_version, but pipeline.ts, match.repo.ts and the Gemini provider were still the old versions.

Effect before the fix: 5 web typecheck errors and 5 failing tests. Saving matches failed (rank cannot be null), and the pipeline returned a RerankResult instead of the list of matches.

What this commit completes:

• Migration 0004_match_rank.sql adds event_matches.rank and computation_version. Existing rows get a rank in the order they are shown today.
• save() stores each match's final position after reranking, and reads sort by rank, so the order stays the same after a page reload.
• Each saved list records how it was ordered: by the model (v1+llm:gemini:<model>) or by score (v1+score).
• Matches the model ranked without a reason get the standard fallback reason.
• New tests: tests/unit/matching-pipeline.test.ts and tests/integration/match-rank.test.ts, which runs against real Postgres.

2. bug fixx-login-challenge-test-isolation

In tests/integration/login-challenge.test.ts, the "attendee queries" tests used the attendee that the login-challenge tests delete when they finish, so the result depended on run order. The login-challenge tests also closed the shared database connection before the second group ran.

• The "attendee queries" tests now create and remove their own attendee.
• The database connection is closed once, after both groups finish.

Verification

• npm run typecheck: passes (4/4 packages)
• npm run lint: passes
• npm test: 78/78 passing (unit and integration)
• npm run build: passes
• npm run db:migrate: database up to date with migration 0004
• Running app: /api/health/ready reports database and Keycloak ready; protected pages redirect to /login?returnTo=…; /api/me returns 401 without a session

Not covered: a logged-in session and match generation with a real Gemini key have not been tested by hand.

Deploy note

Run npm run db:migrate before deploying. Migration 0004 is required for saving matches.

Merge notes

• Merges cleanly with R02 (feature/r02-email-google-config) and R03 (fix/login-redirect-loop-for-expired-sessions).
• Merging into main has one conflict, in ReadMe.md. It comes from R01 (main still has the old Supabase README) and is not caused by this branch.
• fix/r04-persist-match-rank is superseded by this branch and can be closed or deleted.