fix: Comprehensive validation and bug fixes

Infrastructure:
- Add Redis and Celery workers to all docker-compose files
- Fix celery migration race condition in entrypoint.sh
- Add healthchecks and resource limits to dev compose
- Update .env.template with Redis/Celery variables

Backend Models & Schemas:
- Rename Sprint.completed_points to velocity (per requirements)
- Add AgentInstance.name as required field
- Rename Issue external tracker fields for consistency
- Add IssueSource and TrackerType enums
- Add Project.default_tracker_type field

Backend Fixes:
- Add Celery retry configuration with exponential backoff
- Remove unused sequence counter from EventBus
- Add mypy overrides for test dependencies
- Fix test file using wrong schema (UserUpdate -> dict)

Frontend Fixes:
- Fix memory leak in useProjectEvents (proper cleanup)
- Fix race condition with stale closure in reconnection
- Sync TokenWithUser type with regenerated API client
- Fix expires_in null handling in useAuth
- Clean up unused imports in prototype pages
- Add ESLint relaxed rules for prototype files

CI/CD:
- Add E2E testing stage with Testcontainers
- Add security scanning with Trivy and pip-audit
- Add dependency caching for faster builds

Tests:
- Update all tests to use renamed fields (velocity, name, etc.)
- Fix 14 schema test failures
- All 1500 tests pass with 91% coverage

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/lib/hooks/useProjectEvents.ts

@@ -129,6 +129,7 @@ export function useProjectEvents(
   const currentRetryDelayRef = useRef(initialRetryDelay);
   const isManualDisconnectRef = useRef(false);
   const mountedRef = useRef(true);
+  const pingHandlerRef = useRef<(() => void) | null>(null);
 
   /**
    * Update connection state and notify callback
@@ -191,6 +192,12 @@ export function useProjectEvents(
       retryTimeoutRef.current = null;
     }
 
+    // Remove ping listener before closing to prevent memory leak
+    if (eventSourceRef.current && pingHandlerRef.current) {
+      eventSourceRef.current.removeEventListener('ping', pingHandlerRef.current);
+      pingHandlerRef.current = null;
+    }
+
     if (eventSourceRef.current) {
       eventSourceRef.current.close();
       eventSourceRef.current = null;
@@ -286,12 +293,15 @@ export function useProjectEvents(
       };
 
       // Handle specific event types from backend
-      eventSource.addEventListener('ping', () => {
+      // Store handler reference for proper cleanup
+      const pingHandler = () => {
         // Keep-alive ping from server, no action needed
         if (config.debug.api) {
           console.log('[SSE] Received ping');
         }
-      });
+      };
+      pingHandlerRef.current = pingHandler;
+      eventSource.addEventListener('ping', pingHandler);
 
       eventSource.onerror = (err) => {
         if (!mountedRef.current) return;
@@ -355,30 +365,26 @@ export function useProjectEvents(
     clearProjectEvents(projectId);
   }, [clearProjectEvents, projectId]);
 
-  // Auto-connect on mount if enabled
+  // Consolidated connection management effect
+  // Handles both initial mount and auth state changes to prevent race conditions
   useEffect(() => {
     mountedRef.current = true;
 
-    if (autoConnect && isAuthenticated && projectId) {
-      connect();
+    // Connect when authenticated with a project and not manually disconnected
+    if (autoConnect && isAuthenticated && accessToken && projectId) {
+      if (connectionState === 'disconnected' && !isManualDisconnectRef.current) {
+        connect();
+      }
+    } else if (!isAuthenticated && connectionState !== 'disconnected') {
+      // Disconnect when auth is lost
+      disconnect();
     }
 
     return () => {
       mountedRef.current = false;
       cleanup();
     };
-  }, [autoConnect, isAuthenticated, projectId, connect, cleanup]);
-
-  // Reconnect when auth changes
-  useEffect(() => {
-    if (isAuthenticated && accessToken && connectionState === 'disconnected' && autoConnect) {
-      if (!isManualDisconnectRef.current) {
-        connect();
-      }
-    } else if (!isAuthenticated && connectionState !== 'disconnected') {
-      disconnect();
-    }
-  }, [isAuthenticated, accessToken, connectionState, autoConnect, connect, disconnect]);
+  }, [autoConnect, isAuthenticated, accessToken, projectId, connectionState, connect, disconnect, cleanup]);
 
   return {
     events,