Take an AI-built web app (React/Express/Postgres) from MVP to production

TITLE: Take an AI-built web app (React/Express/Postgres) from MVP to production, then package for iOS/Android with Capacitor ABOUT: "Depth" is a focus-training app (8-week program + private accountability groups). A working MVP exists, built AI-assisted on Replit and deployed at a replit.app URL. I need a senior full-stack developer to audit it, harden it, move it to proper production infrastructure, and later ship it to both app stores. No redesign, no new features — productionization only. CURRENT STACK: React 18 + TypeScript + Vite (PWA), Express + TypeScript, PostgreSQL, Drizzle ORM, session-cookie auth, offline-first timer with sync queue, Vitest test suite. Full written product spec and acceptance criteria will be provided (the app was built against a detailed spec — you will not be guessing requirements). SCOPE — MILESTONE 1: Audit & critical fixes - Review the codebase against the provided spec; deliver a written GAPS/risk report (security, data integrity, privacy filtering, timer correctness, test coverage) with effort estimates - Fix critical/security issues only (OWASP basics, session security, rate limiting, headers/CSP, input validation, dependency audit) MILESTONE 2: Production infrastructure (web) - Migrate off Replit hosting to production infra (e.g., Railway/Render/ Fly/Vercel + managed Postgres like Neon/Supabase) with staging + production environments, env/secrets management - GitHub repo + CI/CD (GitHub Actions): tests must pass to deploy - Database migrations discipline + automated backups + restore test - Transactional email (Resend/Postmark): verify signup + add password reset if missing - Monitoring: Sentry, uptime check, privacy-respecting analytics (PostHog or Plausible) - Custom domain, SSL, performance pass (Lighthouse ≥90 PWA/perf) - Keep the existing Vitest suite green; add Playwright E2E for: signup → onboarding → focus session (with mid-session refresh) → shutdown → group check-in MILESTONE 3 (contingent, after pilot): Mobile packaging - Wrap with Capacitor for iOS + Android reusing the existing web code - Device testing: offline mode, timer behavior in background/locked screen, safe-area/RTL rendering - Store assets (icons, splash, screenshots from provided design system) MILESTONE 4 (contingent): Store submission & handover - App Store + Play Store submission incl. privacy/data-safety forms, account-deletion requirement, age rating (18+), review-cycle fixes - Handover: README, runbook, architecture notes, 30-day bug warranty OUT OF SCOPE: redesign, new features, React Native/Flutter rewrite, marketing, content writing. REQUIREMENTS: 4+ yrs TypeScript full-stack; PostgreSQL (Drizzle or similar ORM); has shipped at least one Capacitor (or similar hybrid) app live on BOTH stores — send links; comfortable auditing AI-generated codebases; CI/CD + basic DevOps; security-minded. Nice to have: RTL/i18n experience, Arabic. TO APPLY, answer these 3 questions (applications without them are ignored): (1) links to 1–2 store apps you shipped and your role; (2) in 5 lines, how you'd audit an AI-generated codebase before touching it; (3) your milestone-by-milestone price for M1–M2 and separately M3–M4. Fixed-price per milestone via Upwork escrow only. App link on replit https://depth-focus-training.replit.app/learn