what I builtযা তৈরি করেছি

• Designed the API around one consistent module shape — a Drizzle schema, Zod validators, a service layer, and an OpenAPI route definition per domain — so every feature lands the same way
• Implemented session-based authentication with Better Auth over a Drizzle adapter, covering email verification, password reset, and optional TOTP or email OTP two-factor, with sessions stored in the database and renewed on access inside a fixed update window
• Hardened the auth surface with Argon2id password hashing at a 512 MB memory cost, Have I Been Pwned breach checking on sign-up, database-backed rate limits of 5 sign-in and 3 sign-up attempts per minute, and audit hooks on session and account events
• Generated the OpenAPI 3.1 specification from the same Zod v4 schemas that validate requests at runtime, so the published docs and the enforced validation cannot drift apart
• Sent transactional email through React Email templates and Nodemailer over Gmail SMTP, covering welcome, verification, password reset, and one-time passcodes
• Structured request logging with Pino and hono-pino, shipping to BetterStack in production and human-readable output in development, behind a middleware stack of CORS, secure headers, request IDs, and response compression