You built it with AI. Now finish it

My app works but looks like a default AI-made app. Review the UI and fix the defaults that give it away, one at a time, without changing what the app does:

1. Replace any purple-to-blue gradient backgrounds with one brand colour on a flat background. Ask me for the colour if there isn't one.
2. Replace emoji used as icons with one real icon set (e.g. Lucide or Heroicons), same size and weight everywhere.
3. Stop centring everything: use a grid or edge-aligned layout, and left-align body text.
4. Create a type hierarchy: big bold headings, smaller quiet body text, clear size steps between them.
5. Design every empty state and loading state: what a new user sees before there's any data, and what shows while things load.
6. Flag any AI-generated images with obvious tells (hands, plastic sheen) so I can replace or remove them.
7. Fix spacing: use a consistent spacing scale and give the most important things more room.
8. Rewrite placeholder copy ("Submit", "Error", "No data found") so buttons and messages say what happens, like a person would.

Start by listing what you find for each point, with file names. Then fix them in that order, showing me each change.

Check every form in my app (sign up, log in, contact, settings, search, anything with an input or a submit button) and fix what's broken, without changing what the app does or its wording.

1. List every form with its file name. For each one, check the points below and report what you find before changing anything.
2. Labels: every input has a visible label linked to it (label for= / id, or the input inside the label). A placeholder is not a label.
3. Contrast: typed text and placeholder text are clearly readable in light and dark mode. If an input sets a background colour, it must also set a text colour.
4. Phone: correct input types (email, tel, number, url) so the right keyboard opens, input text at least 16px so iPhones don't zoom, and nothing (especially the submit button) pushed off a narrow screen.
5. Submitting: the button shows that it's working and can't be pressed twice while a request is running. A slow or failed request never looks like nothing happened.
6. Errors: every failure shows a plain-language message next to the field or form, keeps what the user typed, and moves focus to the first problem. No raw error codes, no silent console-only errors.
7. Server checks: everything the browser validates is checked again on the server. List any endpoint or function a form posts to that accepts requests without checking who is calling, and any place user input goes into an email or HTML without being escaped.
8. Small things: autocomplete attributes on name, email and password fields, Enter submits the form, and dialogs don't flash an empty form while closing.

Fix one form at a time and show me each change so I can undo it. Before touching anything on the server, auth, the database or payments, explain the change and give me an undo plan, then wait for my OK.

My app is slow with real users. Find and fix the causes, measuring before and after each change. Don't change what the app does, and don't rewrite anything you haven't measured.

1. Images: list every image over 200 KB in the public folder and where it's shown. Resize to at most twice the displayed size and compress. Keep the same file names if images are referenced in the database.
2. Animations: find always-on CSS animations that change filter, box-shadow, width, height or colours. Rewrite them to animate only opacity and transform, keeping the look.
3. Auth refetching: find onAuthStateChange (or similar) code that refetches or invalidates all data on SIGNED_IN. Only refetch when a different user signs in.
4. Database (if Supabase): I'll paste the Performance Advisor results. For "Auth RLS Initialization Plan", rewrite policies to use (select auth.uid()) instead of auth.uid(). Suggest indexes for slow queries. Before changing any policy, give me an undo script with the current policies, and a way to check each user sees exactly the same rows before and after.
5. Waiting: find places that load data one request after another and could load in parallel, and clicks that wait for the server when the screen could update first.

Report what you find for each point with file names first. Then fix one thing at a time.

My app uses Supabase (or another database the browser talks to directly). Row level security controls who can change which rows, but I want to make sure people can't write impossible values by calling the API directly. Don't change what the app does for normal users.

1. List every table the browser can insert into or update, and for each one, which columns a signed-in user can set.
2. For each of those columns, look at the app's code and tell me the real limits: the biggest and smallest number the app ever sends, allowed text values, required fields. Show me where in the code each limit comes from.
3. Find columns that should only ever be calculated by the database (totals, counts, balances, scores, "verified" or "paid" flags) but that a signed-in user could still set directly.
4. Propose a CHECK constraint for each real limit from step 2, and a trigger that keeps each calculated column from step 3 unchangeable by normal users. Use NOT VALID on new constraints so existing rows aren't touched.
5. Write one read-only SQL query that counts rows breaking each rule, so I can run it daily.

Report your findings with file names first. Then do one change at a time. Before anything that changes the database, give me an undo script, and a way to test the change inside a transaction that rolls back.