SQLite stores datetimes without timezone info (naive), but the code used
datetime.now(timezone.utc) (aware). Subtracting them raised:

  TypeError: can't subtract offset-naive and offset-aware datetimes

Fix: treat naive datetimes from SQLite as UTC before comparison in
_calculate_document_freshness_score().

The backend FindingResponse uses snake_case (confidence_score,
framework_control, finding_type, remediation, created_at) while the
frontend Finding type and all its consuming components (FindingCard,
FindingsList) expected camelCase. This caused a crash on render because
finding.findingType was undefined and .charAt(0) threw a TypeError,
resulting in a completely blank Analysis page.

Changes:
- frontend/src/lib/findings.ts: new normalizeFinding() utility that maps
  every backend field to its camelCase counterpart; splits framework_control
  into controlId and controlName; defaults missing fields safely
- frontend/src/pages/Analysis.tsx: apply normalizeFinding() to API response;
  add FindingsErrorBoundary to catch any future render crashes; read
  ?document_id= URL param to allow vendor/document pages to pre-select a
  document; increase analysis timeout to 180s for LLM calls

…dor page

When navigating to /documents?vendor_id=<id> (e.g. from the vendor detail
page), the upload form now passes vendor_id as a query parameter to the
POST /api/v1/documents endpoint. Previously the parameter was ignored and
documents appeared under Others with no vendor link.

Also increases the upload request timeout to 120s to accommodate large files
and slow document processing.

The View All Findings button previously navigated to /analysis with no
context, leaving the page empty. It now navigates to
/analysis?document_id=<first_analyzed_doc_id> so the document is
pre-selected and existing findings are loaded immediately.

Also applies normalizeFinding() to vendor-level findings so the severity
breakdown sidebar renders correctly.

When the backend was restarted or tokens expired, Zustand's persisted store
could retain isAuthenticated: true while localStorage had no tokens. On the
next page load, ProtectedRoute saw isAuthenticated: true and redirected to
/dashboard, which immediately redirected back to /login, creating a loop.

Three-part fix:
- authStore.ts: init() now explicitly resets user/tokens/isAuthenticated
  to null/false when no tokens are found in localStorage, clearing any
  stale persisted state
- api.ts: 401 response handler also clears the auth-storage Zustand persist
  key so the store resets on the next load after token expiry
- App.tsx: defers route rendering until after init() completes via a ready
  flag, preventing ProtectedRoute/PublicRoute from reading stale Zustand
  state before the reset has run

…mport

Clone modal now fetches real frameworks from GET /api/v1/frameworks and
loads all controls via GET /api/v1/frameworks/{id}/controls. Added a
2-step flow: pick framework, then select controls from a searchable
checkbox list with Select All / Clear shown options. Imports all
selected controls including description, category and guidance fields.