fix(backend): resolve Vercel production ESM module imports

Add .js extensions to relative imports so Node ESM can resolve lib/
modules in serverless (fixes ERR_MODULE_NOT_FOUND on /health).

Add vercel.json for monorepo-root and apps/backend deploy layouts,
include lib/** in function bundles, and set TypeScript module to
NodeNext. Document both Vercel root-directory options in the backend
README.

Author: MarcoAntolini

README.md

@@ -2,6 +2,8 @@
 
 <img src="apps/extension/public/banner.png" alt="CssHub banner" width="800" />
 
+<br />
+
 **Automatically sync your [CSSBattle](https://cssbattle.dev) submissions to GitHub.**
 
 [![Chrome Web Store](https://img.shields.io/badge/Chrome-Web%20Store-4285F4?logo=googlechrome&logoColor=white)](https://chromewebstore.google.com/detail/csshub/jafemcjfpjjdbcfjjfohjfglckbkjbbp)

apps/backend/README.md

@@ -46,7 +46,22 @@ curl http://localhost:3000/api/oauth/github/health
 
 ## Deploying on Vercel
 
-Set the project root to **`apps/backend`**, add the same env vars for Preview and Production, and wire the deployment URL into the extension as `VITE_OAUTH_BACKEND_BASE_URL`. For the full monorepo dev loop, CI variables, and OAuth callback notes, see the [extension README](../extension/README.md) (maintainer sections at the bottom).
+Use **one** of these layouts (both are supported via `vercel.json` in the repo):
+
+### Option A (recommended): Root Directory = `apps/backend`
+
+1. Vercel project **Root Directory** → **`apps/backend`**
+2. Enable **Include source files outside of the Root Directory** (for `@csshub/shared`)
+3. [`apps/backend/vercel.json`](vercel.json) runs `npm ci` from the monorepo root and includes `lib/**` in each function bundle
+4. Add env vars; set extension `VITE_OAUTH_BACKEND_BASE_URL` to this deployment URL
+
+### Option B: Root Directory = repository root
+
+If the project root is the monorepo (function paths like `/var/task/apps/backend/...`), use the repo-root [`vercel.json`](../../vercel.json) instead. Same env vars apply.
+
+Relative imports in this package use **`.js` extensions** (required for Node ESM in production). `vercel dev` may work without them locally; production does not.
+
+For the full monorepo dev loop, CI variables, and OAuth callback notes, see the [extension README](../extension/README.md) (maintainer sections at the bottom).
 
 ## Security & data handling
 

apps/backend/api/oauth/github/exchange.ts

@@ -3,12 +3,12 @@ import {
 	githubOAuthTokenRawSchema,
 	oauthExchangeRequestSchema,
 } from "@csshub/shared";
-import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors";
-import { backendEnv } from "../../../lib/env";
-import { rejectMethod, getClientIp } from "../../../lib/http";
-import { checkRateLimit } from "../../../lib/rateLimit";
-import { consumeOAuthState } from "../../../lib/oauthState";
-import { isAllowedRedirectUri } from "../../../lib/oauth";
+import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors.js";
+import { backendEnv } from "../../../lib/env.js";
+import { rejectMethod, getClientIp } from "../../../lib/http.js";
+import { checkRateLimit } from "../../../lib/rateLimit.js";
+import { consumeOAuthState } from "../../../lib/oauthState.js";
+import { isAllowedRedirectUri } from "../../../lib/oauth.js";
 
 const EXCHANGE_RATE_LIMIT = {
 	limit: 12,

apps/backend/api/oauth/github/health.ts

@@ -1,7 +1,7 @@
 import type { VercelRequest, VercelResponse } from "@vercel/node";
-import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors";
-import { rejectMethod } from "../../../lib/http";
-import { ensureBackendEnvLoaded } from "../../../lib/loadEnv";
+import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors.js";
+import { rejectMethod } from "../../../lib/http.js";
+import { ensureBackendEnvLoaded } from "../../../lib/loadEnv.js";
 
 const REQUIRED_ENV_NAMES = ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET"] as const;
 const OPTIONAL_ENV_NAMES = [

apps/backend/api/oauth/github/state.ts

@@ -1,9 +1,9 @@
 import type { VercelRequest, VercelResponse } from "@vercel/node";
-import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors";
-import { rejectMethod, getClientIp } from "../../../lib/http";
-import { checkRateLimit } from "../../../lib/rateLimit";
-import { issueOAuthState } from "../../../lib/oauthState";
-import { backendEnv } from "../../../lib/env";
+import { handleCorsPreflight, setCorsHeaders } from "../../../lib/cors.js";
+import { rejectMethod, getClientIp } from "../../../lib/http.js";
+import { checkRateLimit } from "../../../lib/rateLimit.js";
+import { issueOAuthState } from "../../../lib/oauthState.js";
+import { backendEnv } from "../../../lib/env.js";
 
 const STATE_RATE_LIMIT = {
 	limit: 20,

apps/backend/lib/env.ts

@@ -1,4 +1,4 @@
-import { ensureBackendEnvLoaded } from "./loadEnv";
+import { ensureBackendEnvLoaded } from "./loadEnv.js";
 
 ensureBackendEnvLoaded();
 

apps/backend/lib/oauth.ts

@@ -1,4 +1,4 @@
-import { backendEnv } from "./env";
+import { backendEnv } from "./env.js";
 
 const REDIRECT_HOST_SUFFIX = ".chromiumapp.org";
 

apps/backend/lib/oauthState.ts

@@ -1,4 +1,4 @@
-import { redisClient } from "./redis";
+import { redisClient } from "./redis.js";
 
 const OAUTH_STATE_TTL_SEC = 10 * 60;
 const memoryStateStore = new Map<string, number>();

apps/backend/lib/rateLimit.ts

@@ -1,4 +1,4 @@
-import { redisClient } from "./redis";
+import { redisClient } from "./redis.js";
 
 type RateLimitConfig = {
 	key: string;

apps/backend/lib/redis.ts

@@ -1,5 +1,5 @@
 import { Redis } from "@upstash/redis";
-import { backendEnv } from "./env";
+import { backendEnv } from "./env.js";
 
 const hasRedisConfig =
 	typeof backendEnv.upstashRedisRestUrl === "string" &&