docs(etc): add production-checklist docs

Author: tyronejosee

docs/auth-security/production-checklist.md

@@ -0,0 +1,99 @@
+# Production Checklist
+
+## Environment Configuration
+
+* [ ] **Environment variables (`.env.production`)**: ensure all sensitive variables are properly defined and read from `process.env`.
+* [ ] **`next.config.js` in production mode**: check settings like:
+  * `images.domains` (if using `next/image`)
+  * `reactStrictMode: true`
+  * `compress: true`
+
+## Build and Optimization
+
+* [ ] Run the build command to generate the optimized production version (`.next` folder):
+
+  ```bash
+  npm run build
+  ````
+
+* [ ] Verify there are no warnings or errors during build.
+* [ ] Review bundle sizes (`next build` shows this). Use [next-bundle-analyzer](https://www.npmjs.com/package/@next/bundle-analyzer) if needed.
+
+## Dependencies
+
+* [ ] Ensure dependencies are clean and up-to-date:
+
+  ```bash
+  npm prune --production
+  ```
+
+* [ ] Use only necessary dependencies in production, remove unnecessary dev packages.
+* [ ] Check for vulnerabilities:
+
+  ```bash
+  npm audit fix --force
+  ```
+
+## Error Handling and Logging
+
+* [ ] Client-side error capturing (`try/catch`, `ErrorBoundary`).
+* [ ] Server-side error capturing (middleware or API handlers).
+* [ ] Integration with a monitoring service: Sentry, LogRocket, Datadog, etc.
+
+## Security
+
+* [ ] Use HTTPS (if on Vercel, Netlify, or behind a proxy).
+* [ ] Enable secure HTTP headers:
+  * Content Security Policy (CSP)
+  * Strict-Transport-Security
+  * X-Content-Type-Options
+  * Referrer-Policy
+* [ ] Disable listing of unnecessary public files.
+* [ ] Do not include `.env*`, `node_modules/`, `tests/`, or any sensitive files in the deployment.
+
+## Authentication and Sessions
+
+* [ ] Cookies configured with:
+  * `Secure`
+  * `HttpOnly`
+  * `SameSite=Strict` or `Lax`
+* [ ] Token refresh if using JWT
+* [ ] Server-side validation (`getServerSideProps`, API Routes) to protect private routes.
+
+## CDN, Images, and Assets
+
+* [ ] Use `next/image` with domain config or custom loader if not using Vercel.
+* [ ] Use cache headers for static assets (`Cache-Control`).
+* [ ] Use a CDN for images or assets if your infrastructure allows it.
+
+## Deployment
+
+* [ ] Choose between:
+  * **Vercel** (recommended for Next.js)
+  * **Docker** + **Nginx**
+  * **Node.js server with PM2**
+
+* [ ] If using Docker:
+  * Multi-stage build
+  * Lightweight image (based on `node:alpine`)
+  * Well-defined volumes with no development leaks
+
+## Testing
+
+* [ ] Unit and integration tests (Jest, Testing Library).
+* [ ] Post-deploy smoke testing.
+* [ ] Manual review on different devices/browsers.
+
+## SEO and Performance
+
+* [ ] Meta tags (`next/head`)
+* [ ] OpenGraph, Twitter cards
+* [ ] Lighthouse score > 90
+* [ ] Sitemaps and `robots.txt`
+* [ ] `manifest.json` file and PWA support if applicable
+
+## Metrics and Monitoring
+
+* [ ] Integration with Google Analytics, Plausible, etc.
+* [ ] Centralized logging if on a custom environment
+* [ ] Error or downtime alerts