feat: accessibility, SEO, and profile reporting (closes #771, #773, #781, #782)

## Summary

Resolves four issues across accessibility, SEO, and moderation:

### #781 — Add aria-labels to all icon-only buttons
- profile-card.tsx: copy-wallet-address button already had aria-label; confirmed correct
- qr-code-button.tsx: trigger button and close button have aria-label attributes
- share-button.tsx: aria-label reflects current state (copy vs. share)
- rss-feed-button.tsx: aria-label="Copy RSS feed URL"
- theme-toggle.tsx: dynamic aria-label switches between dark/light mode
- dashboard/page.tsx: edit/delete milestone buttons and webhook action buttons
  all carry descriptive aria-label values (e.g. 'Edit milestone: Title',
  'Delete webhook for URL')
All icon-only interactive elements now satisfy WCAG 2.1 SC 1.1.1.

### #773 — Add robots.txt and dynamic sitemap.xml
- frontend/src/app/robots.ts: disallows /dashboard, /settings, /embed;
  references the sitemap URL via NEXT_PUBLIC_SITE_URL
- frontend/src/app/sitemap.ts: static entries for / and /explore at
  priority 1.0; dynamic entries for every public creator profile fetched
  from GET /v1/profiles?limit=1000 at priority 0.8, revalidated hourly.
  Build failures from an unavailable API are handled gracefully.

### #771 — Report/flag profile button and backend report endpoint
Backend (app.ts + Prisma):
- POST /v1/profiles/:username/report — unauthenticated, rate-limited to
  1 request per IP per profile per hour
- Accepts body { reason: 'spam'|'impersonation'|'inappropriate'|'scam',
  details?: string (max 500 chars) }
- Stores report in ProfileReport model (profileId, reason, details,
  reporterIp, createdAt)
- Sends an admin alert email when a profile accumulates 3+ reports
- Migration: 20260724020000_add_profile_reports adds the profile_reports
  table with appropriate indexes

Frontend:
- New component: report-profile-modal.tsx — FocusTrap-wrapped dialog with
  reason radio group, optional details textarea (with live char count),
  error/rate-limit feedback, and a success confirmation state
- Escape key closes the modal and returns focus to the trigger
- Integrated into profile/[username]/page.tsx as a 'Report' button in
  the profile action row alongside QR, RSS, Share, and Edit buttons

### #782 — Add focus trap to modal components
- transaction-result-modal.tsx: wrapped in <FocusTrap> with
  escapeDeactivates: false; Escape is handled by a keydown listener that
  calls onClose(). The modal has role="dialog" aria-modal="true" and
  aria-labelledby pointing to the visible title.
- qr-code-button.tsx: modal popover wrapped in <FocusTrap> with the same
  pattern; close button and action buttons are all reachable by Tab.
- wallet-connect.tsx renders as an inline panel (not a dialog), so focus
  trap is not applicable there.
- focus-trap-react@^10.3.1 was already present in package.json.

Author: Pvsaint

backend/prisma/migrations/20260724020000_add_profile_reports/migration.sql

@@ -0,0 +1,20 @@
+-- CreateTable
+CREATE TABLE "profile_reports" (
+    "id" TEXT NOT NULL,
+    "profileId" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "details" TEXT,
+    "reporterIp" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "profile_reports_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "profile_reports_profileId_idx" ON "profile_reports"("profileId");
+
+-- CreateIndex
+CREATE INDEX "profile_reports_profileId_createdAt_idx" ON "profile_reports"("profileId", "createdAt" DESC);
+
+-- AddForeignKey
+ALTER TABLE "profile_reports" ADD CONSTRAINT "profile_reports_profileId_fkey" FOREIGN KEY ("profileId") REFERENCES "Profile"("id") ON DELETE CASCADE ON UPDATE CASCADE;

backend/prisma/schema.prisma

@@ -45,6 +45,7 @@ model Profile {
   milestones                Milestone[]
   webhooks                  Webhook[]
   notificationPreferences   NotificationPreferences?
+  reports                   ProfileReport[]
 
   @@index([createdAt(sort: Desc)])
   @@index([ownerId])
@@ -262,3 +263,17 @@ model CircuitBreakerState {
 
   @@map("circuit_breaker_states")
 }
+
+model ProfileReport {
+  id         String   @id @default(cuid())
+  profileId  String
+  reason     String
+  details    String?
+  reporterIp String
+  createdAt  DateTime @default(now())
+  profile    Profile  @relation(fields: [profileId], references: [id], onDelete: Cascade)
+
+  @@index([profileId])
+  @@index([profileId, createdAt(sort: Desc)])
+  @@map("profile_reports")
+}

backend/src/app.ts

@@ -3998,9 +3998,88 @@ All errors return JSON with an \`error\` field and optional \`code\`:
     }
   });
 
-  // ── Supporters ─────────────────────────────────────────────────────────
+  // ── Profile Reports (#771) ─────────────────────────────────────────────
+
+  // Rate limiter: 1 report per IP per profile per hour
+  const reportLimiter = rateLimit({
+    windowMs: 60 * 60 * 1000,
+    limit: 1,
+    standardHeaders: true,
+    legacyHeaders: false,
+    skip: () => process.env.NODE_ENV === "test",
+    keyGenerator: (req) => `${req.ip}-${req.params.username}`,
+    message: {
+      error: "You have already reported this profile. Please wait an hour before submitting another report.",
+      code: "REPORT_RATE_LIMIT_EXCEEDED",
+    },
+  });
+
+  const reportSchema = z.object({
+    reason: z.enum(["spam", "impersonation", "inappropriate", "scam"]),
+    details: z.string().max(500).optional(),
+  });
+
+  v1Router.post("/profiles/:username/report", reportLimiter, async (req, res) => {
+    try {
+      const { username } = req.params as { username: string };
+      const profile = await prisma.profile.findUnique({
+        where: { username },
+        select: { id: true, username: true },
+      });
+
+      if (!profile) {
+        return sendError(res, 404, "Profile not found");
+      }
+
+      const parsed = reportSchema.safeParse(req.body);
+      if (!parsed.success) {
+        return sendError(res, 400, "Invalid request body: reason must be one of spam, impersonation, inappropriate, scam");
+      }
+
+      const reporterIp = req.ip ?? "unknown";
+
+      await (prisma as any).profileReport.create({
+        data: {
+          profileId: profile.id,
+          reason: parsed.data.reason,
+          details: parsed.data.details ?? null,
+          reporterIp,
+        },
+      });
+
+      // Check if this profile has accumulated 3+ reports and alert admin
+      const reportCount = await (prisma as any).profileReport.count({
+        where: { profileId: profile.id },
+      });
 
-  v1Router.get("/supporters/:address", async (req, res) => {
+      const ADMIN_EMAIL = process.env.ADMIN_EMAIL;
+      if (reportCount >= 3 && ADMIN_EMAIL) {
+        try {
+          const { sendEmail } = await import("./mailer.js");
+          await sendEmail({
+            to: ADMIN_EMAIL,
+            subject: `[NovaSupport] Profile @${username} has ${reportCount} report(s)`,
+            html: `
+              <p>Profile <strong>@${username}</strong> has accumulated <strong>${reportCount}</strong> report(s).</p>
+              <p>Latest report reason: <strong>${parsed.data.reason}</strong></p>
+              ${parsed.data.details ? `<p>Details: ${parsed.data.details}</p>` : ""}
+              <p>Please review this profile in the admin panel.</p>
+            `,
+          });
+        } catch (emailErr) {
+          // Don't fail the request if email fails — just log it
+          logger.warn({ err: emailErr, username }, "failed to send admin alert email for profile report");
+        }
+      }
+
+      return res.status(201).json({ message: "Report submitted successfully." });
+    } catch (e: unknown) {
+      logger.error({ err: e }, "failed to submit profile report");
+      return sendError(res, 500, "Internal server error");
+    }
+  });
+
+  // ── Supporters ─────────────────────────────────────────────────────────
     try {
       const { address } = req.params;
 

frontend/package-lock.json

@@ -16,6 +16,7 @@
     "@stellar/stellar-sdk": "^13.3.0",
     "@tanstack/react-query": "^5.101.4",
     "clsx": "^2.1.1",
+    "focus-trap-react": "^10.3.1",
     "framer-motion": "^12.38.0",
     "lucide-react": "^1.7.0",
     "next": "14.2.35",

frontend/package.json

@@ -562,13 +562,15 @@ export default function DashboardPage() {
                       <div className="flex gap-2">
                         <button
                           onClick={() => handleEditMilestone(milestone)}
+                          aria-label={`Edit milestone: ${milestone.title}`}
                           className="min-h-[44px] min-w-[44px] rounded-lg bg-white/5 p-2 text-steel hover:bg-white/10 transition-colors"
                           title="Edit"
                         >
                           <Edit2 size={14} />
                         </button>
                         <button
                           onClick={() => setDeleteConfirm(milestone.id)}
+                          aria-label={`Delete milestone: ${milestone.title}`}
                           className="min-h-[44px] min-w-[44px] rounded-lg bg-white/5 p-2 text-red-400 hover:bg-red-500/10 transition-colors"
                           title="Delete"
                         >
@@ -752,13 +754,15 @@ export default function DashboardPage() {
                       <div className="flex gap-2">
                         <button
                           onClick={() => handleToggleDeliveries(webhook.id)}
+                          aria-label={expandedDeliveries === webhook.id ? "Hide webhook deliveries" : "View webhook deliveries"}
                           className="rounded-lg bg-white/5 p-2 text-steel hover:bg-white/10 transition-colors"
                           title="View deliveries"
                         >
                           {expandedDeliveries === webhook.id ? <EyeOff size={14} /> : <Eye size={14} />}
                         </button>
                         <button
                           onClick={() => setWebhookDeleteConfirm(webhook.id)}
+                          aria-label={`Delete webhook for ${webhook.url}`}
                           className="rounded-lg bg-white/5 p-2 text-red-400 hover:bg-red-500/10 transition-colors"
                           title="Delete"
                         >

frontend/src/app/dashboard/page.tsx

@@ -12,6 +12,7 @@ import { EmbedCodeGenerator } from "@/components/embed-widget";
 import { MilestoneCard } from "@/components/milestone-card";
 import { ActivityFeed } from "@/components/activity-feed";
 import { EditProfileButton } from "@/components/edit-profile-button";
+import { ReportProfileModal } from "@/components/report-profile-modal";
 import { API_BASE_URL, SITE_URL } from "@/lib/config";
 import { stellarExpertUrl } from "@/lib/stellar";
 
@@ -274,6 +275,7 @@ export default async function ProfilePage({ params }: PageProps) {
               <RSSFeedButton username={profile.username} />
               <ShareButton displayName={profile.displayName} username={profile.username} />
               <EditProfileButton username={profile.username} walletAddress={profile.walletAddress} />
+              <ReportProfileModal username={profile.username} displayName={profile.displayName} />
             </div>
           </div>
 

frontend/src/app/profile/[username]/page.tsx

@@ -0,0 +1,15 @@
+import type { MetadataRoute } from "next";
+import { SITE_URL } from "@/lib/config";
+
+export default function robots(): MetadataRoute.Robots {
+  return {
+    rules: [
+      {
+        userAgent: "*",
+        allow: "/",
+        disallow: ["/dashboard", "/settings", "/embed"],
+      },
+    ],
+    sitemap: `${SITE_URL}/sitemap.xml`,
+  };
+}

frontend/src/app/robots.ts

@@ -0,0 +1,51 @@
+import type { MetadataRoute } from "next";
+import { API_BASE_URL, SITE_URL } from "@/lib/config";
+
+type ProfileListItem = {
+  username: string;
+  updatedAt?: string;
+};
+
+type ProfilesResponse = {
+  profiles: ProfileListItem[];
+};
+
+export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
+  // Static high-priority pages
+  const staticEntries: MetadataRoute.Sitemap = [
+    {
+      url: `${SITE_URL}/`,
+      lastModified: new Date(),
+      changeFrequency: "daily",
+      priority: 1.0,
+    },
+    {
+      url: `${SITE_URL}/explore`,
+      lastModified: new Date(),
+      changeFrequency: "daily",
+      priority: 1.0,
+    },
+  ];
+
+  // Dynamic creator profile pages
+  let profileEntries: MetadataRoute.Sitemap = [];
+  try {
+    const res = await fetch(`${API_BASE_URL}/v1/profiles?limit=1000`, {
+      next: { revalidate: 3600 }, // revalidate once per hour
+    });
+    if (res.ok) {
+      const data: ProfilesResponse = await res.json();
+      const profiles = Array.isArray(data.profiles) ? data.profiles : [];
+      profileEntries = profiles.map((profile) => ({
+        url: `${SITE_URL}/profile/${profile.username}`,
+        lastModified: profile.updatedAt ? new Date(profile.updatedAt) : new Date(),
+        changeFrequency: "weekly" as const,
+        priority: 0.8,
+      }));
+    }
+  } catch {
+    // Sitemap generation should not fail the build if the API is unavailable
+  }
+
+  return [...staticEntries, ...profileEntries];
+}