change frontend routing strategy to hash

backend/app/models/board.py

@@ -28,7 +28,7 @@ class Board(db.Model, SoftDeleteMixin):
     )
 
     # Timestamps
-    date_last_activity = db.Column(db.DateTime)
+    date_last_activity = db.Column(db.DateTime, default=lambda: datetime.now(UTC))
     date_last_view = db.Column(db.DateTime)
     created_at = db.Column(db.DateTime, default=lambda: datetime.now(UTC))
     updated_at = db.Column(

backend/app/models/card.py

@@ -38,7 +38,7 @@ class Card(db.Model, SoftDeleteMixin):
     )
 
     # Timestamps
-    date_last_activity = db.Column(db.DateTime)
+    date_last_activity = db.Column(db.DateTime, default=lambda: datetime.now(UTC))
     created_at = db.Column(db.DateTime, default=lambda: datetime.now(UTC))
     updated_at = db.Column(
         db.DateTime,

backend/app/routes/home.py

@@ -1,6 +1,19 @@
+"""Serves the built React SPA.
+
+With hash-based routing, client-side routes never reach the server
+(e.g. /#/boards/123 arrives as GET /). The only paths ever requested are:
+
+  1. "/"          -> the SPA entry point (index.html)
+  2. "/<static>"  -> real files in the built static/ folder (JS, CSS, icons)
+
+Everything else is a scanner probe (e.g. /.env, /cgi-bin/status,
+/xmlrpc.php) and correctly gets 404. There is deliberately NO catch-all
+that returns index.html for arbitrary paths.
+"""
+
 import os
 
-from flask import Blueprint
+from flask import Blueprint, abort
 from flask import current_app as app
 from flask import send_from_directory
 
@@ -13,7 +26,7 @@ def serve_root():
 
 
 @home_bp.route("/<path:path>")
-def serve_spa(path):
+def serve_static(path):
     if os.path.exists(os.path.join(app.static_folder, path)):
         return send_from_directory(app.static_folder, path)
-    return send_from_directory(app.static_folder, "index.html")
+    return abort(404)

docker/deployment.md

@@ -0,0 +1 @@
+deployment is through the Dockerfile

frontend/src/components/BoardDetailLayout.tsx

@@ -7,7 +7,7 @@ export const BoardDetailLayout = ({ children }: { children: ReactNode }) => {
 
   return (
     <div className="relative">
-      <div className="pr-6">{children}</div>
+      <div className="md:pr-6">{children}</div>
       {id && (
         <div className="">
           <BoardSidebar boardId={id} />

frontend/src/components/kanban/KanbanColumn.tsx

@@ -68,7 +68,7 @@ export function KanbanColumn({
   };
 
   return (
-    <div className="bg-gray-800 rounded-lg py-4 min-w-[300px] max-w-[300px] border border-gray-700 flex flex-col max-h-[calc(100vh-280px)] pr-2">
+    <div className="bg-gray-800 rounded-lg py-4 min-w-[300px] max-w-[300px] border border-gray-700 flex flex-col max-h-[calc(100vh-292px)] pr-2">
       <div className="mb-4 px-4">
         <div className="flex items-center justify-between mb-2">
           <div className="flex items-center gap-2 flex-1">

frontend/src/hooks/useApi.ts

@@ -32,6 +32,13 @@ api.interceptors.request.use(
   (error) => Promise.reject(error)
 );
 
+// Extract the current route path from the hash (e.g. "#/boards/123" -> "/boards/123").
+// With HashRouter the pathname is always "/", so the real route lives in the fragment.
+const getRoutePath = () => {
+  const hash = window.location.hash;
+  return hash ? hash.replace(/^#/, '') : '/';
+};
+
 // Handle response errors
 api.interceptors.response.use(
   (response) => response,
@@ -41,9 +48,10 @@ api.interceptors.response.use(
       localStorage.removeItem('token');
       localStorage.removeItem('user');
 
-      if (!['/login', '/register'].includes(window.location.pathname)) {
-        const currentPath = window.location.pathname;
-        window.location.href = `/login?redirect=${encodeURIComponent(currentPath)}`;
+      const currentPath = getRoutePath();
+      if (!['/login', '/register'].includes(currentPath)) {
+        // Hash-router login URL: the whole route + query string lives inside the hash
+        window.location.href = `#/login?redirect=${encodeURIComponent(currentPath)}`;
       }
     }
     return Promise.reject(error);

frontend/src/main.tsx

@@ -1,16 +1,16 @@
 import React from 'react';
 import ReactDOM from 'react-dom/client';
-import { BrowserRouter } from 'react-router-dom';
+import { HashRouter } from 'react-router-dom';
 import { AppProvider } from './context/AppContext';
 import App from './App.tsx';
 import './index.css';
 
 ReactDOM.createRoot(document.getElementById('root')!).render(
   <React.StrictMode>
-    <BrowserRouter>
+    <HashRouter>
       <AppProvider>
         <App />
       </AppProvider>
-    </BrowserRouter>
+    </HashRouter>
   </React.StrictMode>
 );

frontend/src/pages/BoardDetail.tsx

@@ -245,9 +245,8 @@ export function BoardDetail() {
         </div>
       </WidePageLayout>
 
-      <div className="px-4 sm:px-6 lg:px-8">
         <div className="flex justify-between items-start gap-6">
-          <div className="flex-1">
+          <div className="flex-1 overflow-x-auto">
             <DndContext
               sensors={sensors}
               collisionDetection={closestCenter}
@@ -292,6 +291,5 @@ export function BoardDetail() {
           </div>
         </div>
     </div>
-    </div>
   );
 }