Combines fixes from PRs #34 and #35 into a clean single branch.
## Profile fetch fix (was PR #34)
- CuratedBox.js: Fetch user profile from /api/profile/:userId before
generating box. Use actual user preferences (colors, styles, budget)
instead of hardcoded placeholders.
## Affiliate env var fix (was PR #35)
- init-db.js, server.js: Read AMAZON_ASSOCIATE_ID from env var, fall
back to 'greybeardhold-20'. Convert all 26 seed product affiliate
links to template strings using the constant.
- .env.example: Add AMAZON_ASSOCIATE_ID configuration example.
## CORS lockdown
- server.js: Restrict CORS to specific origins (localhost:3000,
wardrobe.scoble.me) instead of wildcard '*'.
## Auth TODO
- CuratedBox.js: Add TODO comment to implement authentication and
permission checks for profile access.
## Style validation fix
- server.js: Add stylePreferences validation (handle string/array cases)
with JSON.parse fallback in the /api/box endpoint.
## Minor fix
- server.js: Fix leading space in Pact Women's Cotton Cardigan title.
