fix: API response compression, toast z-index above modals, WebSocket …

[thevictorJ]

Summary

This PR fixes four issues covering performance, UI layering, security, and UX.

#786 — Compress API responses (perf)

• Turned on gzip/brotli compression for API route responses.
• Set a size threshold so small payloads are sent uncompressed and don't pay the compression cost.
• Measured how much smaller large responses get (before/after numbers below).
• Checked that clients decode compressed responses correctly (Content-Encoding is set and responses parse as expected).

#785 — Toasts render above modal overlays (bug)

• Added one z-index scale (base, dropdown, sticky, overlay, modal, toast, tooltip) and documented it.
• Toasts now always sit above modals and their overlays.
• Checked stacking contexts so toasts aren't trapped under a parent that creates its own stacking context. Toasts render through a portal at the root.
• Added a test that toasts stay visible while a modal is open.

#784 — Validate WebSocket Origin (security)

• Origin header is checked during the WebSocket upgrade against an allowlist taken from config.
• Connections from origins not on the allowlist are rejected before the upgrade finishes.
• Added authentication when a connection is opened (token or session check).
• Added tests for allowed origins, rejected origins, and a missing Origin header.

#783 — ProductCard hover shows it's clickable (ux)

• Added a pointer cursor, a slight lift on hover, and a faint border on hover.
• Added a focus-visible style so keyboard users get the same cue.
• Added tests for the hover and focus styles.

Testing

• Large API response returns Content-Encoding: br/gzip. Size before: ___ / after: ___
• Toast fires while a modal is open and shows on top
• WebSocket from a disallowed origin is rejected; allowed origin connects
• ProductCard shows its hover and focus states (mouse and keyboard)
• Lint, type-check, and test suite all pass

Closes #786
Closes #785
Closes #784
Closes #783

[drips-wave]

@thevictorJ Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[netlify]

❌ Deploy Preview for boisterous-sunshine-dd4c4c failed.

Name	Link
🔨 Latest commit	de60188
🔍 Latest deploy log	https://app.netlify.com/projects/boisterous-sunshine-dd4c4c/deploys/6ad1fd4ccbd7eeb7c4856c38