Multi-cohort support with per-member initial balance

.dockerignore

@@ -0,0 +1,11 @@
+backend/target
+backend/data
+backend/*.sqlite*
+backend/remote-dbs
+backend/uploads
+frontend/node_modules
+frontend/.svelte-kit
+frontend/build
+node_modules
+.git
+.claude

.gitignore

@@ -5,3 +5,5 @@ node_modules
 backend/uploads
 .dev-ports
 .playwright-cli
+.claude/worktrees/
+.vercel

.vercelignore

@@ -0,0 +1,7 @@
+backend/target
+backend/data
+backend/*.sqlite*
+backend/remote-dbs
+.git
+.claude
+node_modules

AGENTS.md

@@ -256,7 +256,7 @@ Copy the appropriate template to `frontend/.env` for your use case:
 
 #### `backend/src/main.rs`
 - **Entry point** for the backend server
-- Initializes Axum router with WebSocket handler at `/api`, image upload/serving routes, and Airtable sync endpoint
+- Initializes Axum router with per-cohort WebSocket handler at `/api/ws/:cohort_name`, admin/user REST endpoints, and image upload/serving routes
 - Implements port binding with fallback logic (tries sequential ports if in use)
 - Manages uploads directory and request body size limits
 - Depends on `lib.rs` for `AppState`, `handle_socket.rs` for WebSocket handling
@@ -266,7 +266,7 @@ Copy the appropriate template to `frontend/.env` for your use case:
 - Defines `AppState` struct containing DB connection pool, pub/sub subscriptions, and rate limiters
 - Configures separate admin/user rate limit quotas for expensive queries and mutations
 - Includes protobuf module generation via `build.rs`
-- Declares modules: `websocket_api`, `auth`, `db`, `handle_socket`, `subscriptions`, `airtable_users`, `convert`, `seed`, `test_utils`
+- Declares modules: `websocket_api`, `auth`, `db`, `global_db`, `handle_socket`, `subscriptions`, `convert`, `seed`, `test_utils`
 
 #### `backend/src/handle_socket.rs`
 - Core WebSocket request/response handler (~1150 lines)
@@ -301,11 +301,6 @@ Copy the appropriate template to `frontend/.env` for your use case:
 - Implements `From` trait for all domain types (Portfolio, Market, Order, Trade, Transfer, Account, Auction)
 - Converts Rust Decimal to protobuf floats, timestamps to protobuf Timestamp format
 
-#### `backend/src/airtable_users.rs`
-- Syncs Airtable student records to Kinde and database
-- Creates Kinde accounts and DB entries, assigns initial balances based on product ID
-- Caches Kinde API tokens, logs errors back to Airtable
-
 #### `backend/src/seed.rs`
 - Development seed data (feature-gated behind `dev-mode`)
 - Seeds fresh databases with test accounts (Alice, Bob, Charlie, Admin), markets, orders, and trades

DEPLOY.md

@@ -0,0 +1,86 @@
+# Deployment
+
+## Architecture
+
+- **Frontend**: Static SPA on Vercel (SvelteKit with `adapter-static`)
+- **Backend**: Rust binary on Fly.io (Docker, SQLite with persistent volume)
+- Frontend and backend are on different domains, so HTTP API calls use cross-origin requests with CORS.
+
+## Staging
+
+- **Frontend**: https://platform-staging-five-gamma.vercel.app (Vercel project `platform-staging` under `trading-bootcamp` team)
+- **Backend**: https://trading-bootcamp-staging.fly.dev (Fly app `trading-bootcamp-staging`)
+
+### Deploy staging backend
+
+```bash
+fly deploy --config backend/fly.staging.toml
+```
+
+### Deploy staging frontend
+
+```bash
+vercel --prod --scope trading-bootcamp
+```
+
+### Vercel env vars (Production environment)
+
+| Variable | Value |
+|----------|-------|
+| `PUBLIC_KINDE_CLIENT_ID` | `a9869bb1225848b9ad5bad2a04b72b5f` |
+| `PUBLIC_KINDE_DOMAIN` | `https://account.trading.camp` |
+| `PUBLIC_KINDE_REDIRECT_URI` | `https://platform-staging-five-gamma.vercel.app` |
+| `PUBLIC_SERVER_URL` | `wss://trading-bootcamp-staging.fly.dev/api` |
+| `PUBLIC_TEST_AUTH` | `false` |
+
+**Important**: When setting env vars via `vercel env add`, pipe with `printf` (not `echo`) to avoid embedding trailing newlines:
+```bash
+printf 'value' | vercel env add VAR_NAME production --scope trading-bootcamp
+```
+
+### Kinde setup
+
+Add the frontend URL to "Allowed callback URLs" in the Kinde application settings for client ID `a9869bb1225848b9ad5bad2a04b72b5f`.
+
+## Code changes required for deployment
+
+### 1. `.dockerignore`
+
+Excludes `backend/target`, `backend/data`, SQLite files, `node_modules`, `.git`, `.claude` etc. Without this, Docker context transfer is ~733MB instead of ~700KB.
+
+### 2. `backend/Dockerfile` modifications
+
+- **`ENV SQLX_OFFLINE=true`**: SQLx does compile-time query checking against a live database by default. In Docker there's no database, so offline mode uses the pre-generated `.sqlx/` cache instead.
+- **`COPY ./backend/global_migrations /app/global_migrations`**: The multi-cohort feature added a `global_migrations/` directory that needs to be in the runtime image.
+
+### 3. `.vercelignore`
+
+Excludes the same heavy directories from Vercel uploads.
+
+### 4. CORS: `backend/Cargo.toml` + `backend/src/main.rs`
+
+Since frontend (Vercel) and backend (Fly.io) are on different domains, the browser blocks cross-origin API requests. The fix:
+
+- Added `"cors"` feature to `tower-http` in `Cargo.toml`
+- Replaced the manual `SetResponseHeaderLayer` for `Access-Control-Allow-Origin: *` with `CorsLayer::permissive()`, which properly handles preflight OPTIONS requests and allows the `Authorization` header
+
+### 5. Cross-origin HTTP API calls: `frontend/src/lib/apiBase.ts`
+
+In development, the Vite dev server proxies `/api/*` to the backend (see `frontend/vite.config.ts`). In production, there's no proxy — the frontend and backend are on different domains.
+
+`apiBase.ts` derives the HTTP base URL from `PUBLIC_SERVER_URL`:
+- `wss://host.fly.dev/api` → `https://host.fly.dev`
+- `ws://localhost:8080` → `http://localhost:8080`
+
+`cohortApi.ts` and `adminApi.ts` use `API_BASE` to make absolute URL requests instead of relative `/api/...` paths. This works in both dev (Vite proxy still intercepts) and production (direct cross-origin requests).
+
+### 6. `frontend/src/routes/[cohort_name]/docs/[slug]/+page.svelte`
+
+Fixed markdown import paths — the file moved one level deeper into `[cohort_name]/` so the relative imports needed an extra `../` (e.g. `../../../../../docs/` → `../../../../../../docs/`).
+
+### 7. `backend/fly.staging.toml`
+
+Fly.io config for the staging app. Key differences from production (`fly.toml`):
+- `app = 'trading-bootcamp-staging'`
+- Separate persistent volume mount (`trading_bootcamp_staging`)
+- Staging database path

backend/.gitignore

@@ -3,3 +3,6 @@ target/
 db.sqlite
 db.sqlite-shm
 db.sqlite-wal
+*.sqlite
+*.sqlite-shm
+*.sqlite-wal