feat: add analysis pages and raster risk map

Ship a new app version with broader analytics, restructured
dashboards, and a server-rendered risk map.

Frontend:
- Add Overview, Demographic, Disease, and Environmental Health
  analysis pages
- Add AnomalyMarkers, CalendarHeatmap, and MetricHeatmapTable
  components
- Rebuild Alerts map onto server-rendered raster risk tiles;
  expand Monitoring, Trend, and District Comparison views
- Extend API client, stores, and TypeScript types

Backend:
- Add environment router (pollutants, lag correlations)
- Add risk_raster util serving XYZ 100m risk tiles
- Expand cases endpoints (demographics, seasonality, diagnoses)
  and insights; harden auth and file-based loaders

Data & tooling:
- Add processed outpatient/inpatient/combined case parquet (LFS)
- Add nested CLAUDE.md guides, pyrightconfig, and test updates

backend/auth/service.py

@@ -8,7 +8,13 @@ from passlib.context import CryptContext
 
 logger = logging.getLogger("cbpoa.auth")
 
-SECRET_KEY = os.getenv("AUTH_SECRET_KEY", "cbpoa-dev-secret-change-in-production")
+_DEFAULT_SECRET = "cbpoa-dev-secret-change-in-production"
+SECRET_KEY = os.getenv("AUTH_SECRET_KEY", _DEFAULT_SECRET)
+if SECRET_KEY == _DEFAULT_SECRET:
+    logger.warning(
+        "AUTH_SECRET_KEY is not set — using the built-in development secret. "
+        "Set AUTH_SECRET_KEY in the environment before deploying; the default is public and allows token forgery."
+    )
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("AUTH_TOKEN_EXPIRE_MINUTES", "480"))
 
@@ -61,6 +67,10 @@ def create_access_token(data: dict) -> str:
 def decode_access_token(token: str) -> dict | None:
     try:
         payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        # python-jose ignores PyJWT's options={"require": [...]}, so enforce exp manually:
+        # a token with no exp claim would otherwise never expire.
+        if "exp" not in payload:
+            return None
         return payload
     except JWTError:
         return None