Email: send AI-interview invitation with proctoring rules on auto and manual shortlist

Fix: applications must save even without a valid token (optional auth on apply)

Make real AI reliable: raise timeouts (45s) + max_tokens for gemini-2.5 thinking so scoring/agent/CV calls return JSON instead of timing out to fallback; remove public test-email endpoint

Security: remove public test-email endpoint; require auth on send-reminders

Polish emails: branded action buttons + app links, application-received confirmation email on apply, cleaner footer

Email via Brevo HTTP API (HF blocks SMTP); SMTP kept as fallback; diagnose reports transport

Add /applications/test-email diagnostic to verify SMTP sends + surface exact error

Resume analysis upgrade: structured CV↔JD analysis (sub-scores, matched/missing skills, experience, summary, verdict), .docx parsing, strong skills-based fallback; store full cv_analysis

Use current Gemini model via GEMINI_MODEL env var (default gemini-2.5-flash); gemini-2.0-flash is deprecated/shut down

Add /interview/ai-status diagnostic to pinpoint Gemini key/quota issues

Agentic AI (#4): autonomous interview agent decides probe-vs-advance after each answer, generates targeted follow-ups, logs decisions to the report

Auth/Privacy (#7): JWT issuance+verification, PBKDF2 password hashing (backward compatible), protect applications/report/CV endpoints, GDPR delete-my-data endpoint

Reminders (#8): background scheduler emails candidates with incomplete AI interviews + manual /send-reminders endpoint

Emotion/sentiment analysis: derive facial emotion from blendshapes, add emotion_analysis (dominant/distribution/composure) to report

SMTP: email candidates on shortlist/hire/reject (background, configurable via env)

Don't score transcription failures: null confidence/clarity/engagement when audio can't be processed; backfill repairs existing reports

Add backfill endpoint to link existing completed interviews to applications

Link interview score + session to application so the company dashboard shows results

CORS: allow all *.vercel.app origins via regex (exact-match wildcards don't work)

Report: full violation objects in integrity_flags, skill_breakdown as dict, robust candidate-name lookup

Eye tracking: EAR blink detection, attention/suspicion scores, feed integrity; live HUD in interview

Jobs: accept recruiter custom_questions + required_topics (feed AI interview)

Question generation: CV+JD personalization, mixed types, seniority calibration, company custom questions/required topics; persist cv_text

Interview: hang-proof AI calls (thread timeout), JSON structured scoring, skill breakdown + quoted report

Interview: fail-fast on Gemini quota/429 (max_retries=1) to avoid request hangs

Interview upgrades: MongoDB persistence, adaptive follow-ups, voice analysis, integrity score

Initial commit: BotBoss backend (own deployment)