ui: mobile hamburger menu, nav rename, honest provenance copy

[saquibreja7-hash]

Changes

• Mobile menu fix: replaced the flaky native <details> menu (its <summary> toggle was suppressed by the button styling) with a real client-side MobileMenu component. Reliable tap toggle on mobile, closes on link tap / outside tap / Escape, accessible (aria-expanded/aria-controls). Uses a hamburger icon that becomes an X when open.
• Nav rename: 'Check image' → 'Check AI / Deepfake' (EN + HI).
• Honest copy on /check-image: removed the 'Runs entirely in your browser' badge and reworded the hero subtitle + privacy note, since the OpenAI deeper check does upload. They now say the first check runs on-device and nothing is sent anywhere unless the user chooses the deeper check.
• Docs: fixed a stale .env.example comment that wrongly named Azure; the database is Neon.

Verification

• type-check clean, JSON valid, lint clean (pre-existing warnings only).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
meri-asmita	Ready	Preview	Aug 2, 2026 3:06pm

[claude]

Review summary

Scope: .env.example (Azure→Neon connection-string docs), mobile hamburger menu component (MobileMenu.tsx replacing the <details> nav), nav label rename ("Check image" → "Check AI / Deepfake"), and copy updates on /check-image (hero sub + privacy note) in en/hi.

Safety invariants: No code paths here touch URL/media handling, Aadhaar, notice dispatch, hash submission, or the ENABLE_HASH_UPLOAD/ENABLE_PLATFORM_API gates. The copy change removes the "never uploaded"/"runs entirely in your browser" claims and replaces them with accurate wording ("only sent if you choose the deeper check") — verified against the existing check.deep.* flow in ImageChecker.tsx and /api/check-image/route.ts, which is gated behind the off-by-default ENABLE_PROVENANCE_CHECK flag, requires explicit consent + age confirmation, and is documented in ADR 002. This PR doesn't change that route; it just makes the front-end copy match what the code already does, which is an improvement (previously the copy was inaccurate once the deep-check feature shipped).

Security/business-logic/data-integrity: Nothing in this diff touches auth, CSRF, rate limiting, encryption, case lifecycle, notice/hash dispatch, or the audit chain. MobileMenu.tsx is a client-only nav affordance (open/close state, outside-click/Escape handlers) with no data fetching or side effects of note.

Minor (not blocking): the now-unused check.privacy.badge i18n key is left in both en.json/hi.json after the badge <div> was removed from check-image/page.tsx — harmless dead string, not flagging as a line comment since it's cleanup/style.

No CRITICAL or WARNING findings within the review's focus areas.

Verdict: PASS