feat(milestones): persist milestone data server-side via /api/milestones

[nyxsky404]

Summary

MilestonePlanner was storing all milestone data exclusively in localStorage. This meant milestones were silently lost whenever a user switched devices, used a different browser, opened an incognito window, or cleared browser storage. This PR replaces localStorage with a proper server-side persistence layer that follows the same patterns as the existing Goals feature.

Closes #2303

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)

---

What Changed

Database

• supabase/migrations/20260610000000_add_milestones.sql — new milestones table with user_id, title, description, target_value, current_value, unit, target_date, category, created_at. Includes check constraints that mirror API validation.

API Routes

• src/app/api/milestones/route.ts — GET (list user's milestones, capped at 20) and POST (create with full validation: title sanitisation via stripHtml, integer bounds, per-user limit)
• src/app/api/milestones/[id]/route.ts — PATCH (update current_value only, clamped to target_value) and DELETE (user-scoped, no accidental cross-user deletion)

Component

• src/components/MilestonePlanner.tsx — removed STORAGE_KEY and all localStorage calls; replaced with API fetch on mount and API calls on create/increment/delete. Increment uses optimistic UI with rollback. Delete uses optimistic removal with reload-on-failure. Added loading and saving states, and an error display with role="alert".

---

How to Test

1. Apply the migration to your Supabase project.
2. Go to /dashboard and open the Milestone Planner widget.
3. Create a milestone — it should appear immediately (optimistic) and persist in the DB.
4. Click +1 on a milestone — progress should update instantly.
5. Open the same page in a different browser or device and confirm the milestones are still present.
6. Delete a milestone — it should disappear immediately and be removed from the DB.

Expected result: All milestones survive across devices, browsers, and storage clears.

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• No TypeScript errors introduced (pnpm run type-check — errors shown are all pre-existing)
• Auth guard (session?.githubId) on all API routes — unauthenticated requests return 401
• All DB operations scoped to user_id — no cross-user data access possible
• User input sanitised with stripHtml before DB insert
• Per-user cap (20) prevents storage abuse

---

Additional Context

API request bodies use camelCase (targetValue, currentValue) to match JavaScript conventions; the DB schema uses snake_case (target_value, current_value) following the existing project schema style. The Milestone interface in the component was updated to match DB column names directly, eliminating a manual mapping layer.

[vercel]

@nyxsky404 is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[nyxsky404]

The CI failures on this PR (Playwright smoke tests and Playwright visual regression) are pre-existing broken tests on main — they are not caused by the changes in this PR.

Root causes fixed:

• e2e/streak.spec.ts — duplicate aria-label on streak card div and tooltip button caused a strict-mode locator violation
• Visual regression — test heading selector @playwright-user's profile never matched the actual h1 (@playwright-user)
• landing-page-dark.png snapshot was accidentally zeroed in a prior merged commit
• Public profile test — no Supabase mock for server-side profile fetch in CI, so the page returned 404

Fixes have been applied to this branch. CI is Green.

[Priyanshu-byte-coder]

This PR has merge conflicts with the current main branch. Please rebase or merge main into your branch to resolve the conflicts, then push the updated branch. Once conflicts are resolved, this PR will be merged.

git fetch origin main
git merge origin/main
# resolve conflicts
git push