Security cleanup + /links page (self-hosted Linktree)

[junaiddshaukat]

🔒 Security: remove the injected payload

The Abdul-Moiz31 account was compromised. It force-pushed forged copies of real commits to every branch on 2026-05-30, 08-17, 09-03 and 09-08, keeping the original message, author and date. The current main (6492330) is a forged copy of the real PR #51 merge 875319d. It does two things:

• It hides an obfuscated loader (~48 KB, pushed off-screen with whitespace) after export default config; in postcss.config.mjs. The loader runs on every next dev and next build, fetches its next stage through Ethereum RPC endpoints, and spawns a detached child_process.
• It adds attacker tooling entries (temp_auto_push.bat, temp_interactive_push.bat, branch_structure.json) to .gitignore.

The first forgery (2d5ed64, disguised as "feat: revert vps deployment") also removed .env and .env.local from .gitignore.

The first commit in this PR restores postcss.config.mjs to the clean 8-line config and restores .gitignore byte-for-byte to the legitimate 8d31f82. After that commit, the tree matches the real 875319d except for the restored .gitignore.

Don't run npm install, npm run dev or npm run build on any checkout of main from before this PR is merged.

Follow-ups outside this PR: rotate the Vercel env secrets, restore the other branches, and protect main against force-pushes.

✨ Add /links (self-hosted Linktree)

Adds devweekends.com/links. Every link from linktr.ee/DevWeekends now lives on our own site.

• app/links/page.tsx: a Linktree-style page with the avatar, bio, social icons (Instagram, YouTube, LinkedIn, Facebook, GitHub, Discord), the "Join our Communities" header and 51 pill buttons. It uses the same dark theme as our Linktree: #040404 background, #444 soft-shadow buttons, DM Sans.
• lib/links-data.ts: all links as typed data, in Linktree order. Adding or removing a link is a one-line change.
• public/links/: thumbnails downloaded from Linktree, deduplicated (51 → 36 files) and resized to 128px (~180 KB total). The page doesn't depend on Linktree's CDN.
• components/links-share-button.tsx: a share button in the corner (native share sheet, with clipboard fallback).
• The site header and footer are hidden on /links, so it reads like a Linktree page.
• /links is added to sitemap.ts and llms.txt.
• Linktree references now point to /links: the footer icon, the careers "Share a Job" button, the home page CTAs, README, CONTRIBUTING and the issue-template contact link.

I also fixed some content while copying: "Calander" → "Calendar", consistent title case ("DJANGO COMMUNITY" → "Django Community", "Vue js community" → "Vue.js Community", and so on), and trimmed trailing spaces. All URLs are unchanged.

Testing

I didn't build this locally, because we're not running repo code on dev machines during the incident. CI (npm ci, lint, build) runs on this PR against the cleaned tree.

• CI passes
• After deploy: /links renders, each button opens the right link, and the share button works on mobile
• After deploy: the production build comes from this merge, not a forged commit

🤖 Generated with Claude Code