Add secret management guide, client-side performance monitoring, and search accessibility enhancements

- Introduced a comprehensive Secret Management Guide detailing best practices, secret classification, development setup, production management, rotation procedures, and emergency protocols.
- Implemented a client-side performance monitoring script to track various metrics including page load performance, paint metrics, layout shifts, and memory usage.
- Enhanced search accessibility with keyboard navigation support for search results, ensuring compliance with WCAG standards and improving user experience.

backend/apps/moderation/tests/test_admin.py

@@ -0,0 +1,220 @@
+"""
+Tests for moderation admin interfaces.
+
+These tests verify the functionality of edit submission, photo submission,
+state log, and history event admin classes including query optimization
+and custom moderation actions.
+"""
+
+import pytest
+from django.contrib.admin.sites import AdminSite
+from django.contrib.auth import get_user_model
+from django.test import RequestFactory, TestCase
+
+from apps.moderation.admin import (
+    EditSubmissionAdmin,
+    HistoryEventAdmin,
+    ModerationAdminSite,
+    PhotoSubmissionAdmin,
+    StateLogAdmin,
+    moderation_site,
+)
+from apps.moderation.models import EditSubmission, PhotoSubmission
+
+User = get_user_model()
+
+
+class TestModerationAdminSite(TestCase):
+    """Tests for ModerationAdminSite class."""
+
+    def setUp(self):
+        self.factory = RequestFactory()
+
+    def test_site_configuration(self):
+        """Verify site header and title are set."""
+        assert moderation_site.site_header == "ThrillWiki Moderation"
+        assert moderation_site.site_title == "ThrillWiki Moderation"
+        assert moderation_site.index_title == "Moderation Dashboard"
+
+    def test_permission_check_requires_moderator_role(self):
+        """Verify only moderators can access the site."""
+        request = self.factory.get("/moderation/")
+
+        # Anonymous user
+        request.user = type("obj", (object,), {"is_authenticated": False})()
+        assert moderation_site.has_permission(request) is False
+
+        # Regular user
+        request.user = type("obj", (object,), {
+            "is_authenticated": True,
+            "role": "USER"
+        })()
+        assert moderation_site.has_permission(request) is False
+
+        # Moderator
+        request.user = type("obj", (object,), {
+            "is_authenticated": True,
+            "role": "MODERATOR"
+        })()
+        assert moderation_site.has_permission(request) is True
+
+        # Admin
+        request.user = type("obj", (object,), {
+            "is_authenticated": True,
+            "role": "ADMIN"
+        })()
+        assert moderation_site.has_permission(request) is True
+
+
+class TestEditSubmissionAdmin(TestCase):
+    """Tests for EditSubmissionAdmin class."""
+
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.site = AdminSite()
+        self.admin = EditSubmissionAdmin(model=EditSubmission, admin_site=self.site)
+
+    def test_list_display_fields(self):
+        """Verify all required fields are in list_display."""
+        required_fields = [
+            "id",
+            "user_link",
+            "content_type_display",
+            "content_link",
+            "status_badge",
+            "created_at",
+            "handled_by_link",
+        ]
+        for field in required_fields:
+            assert field in self.admin.list_display
+
+    def test_list_select_related(self):
+        """Verify select_related is configured."""
+        assert "user" in self.admin.list_select_related
+        assert "content_type" in self.admin.list_select_related
+        assert "handled_by" in self.admin.list_select_related
+
+    def test_readonly_fields(self):
+        """Verify submission fields are readonly."""
+        assert "user" in self.admin.readonly_fields
+        assert "content_type" in self.admin.readonly_fields
+        assert "changes" in self.admin.readonly_fields
+        assert "created_at" in self.admin.readonly_fields
+
+    def test_moderation_actions_registered(self):
+        """Verify moderation actions are registered."""
+        request = self.factory.get("/admin/")
+        request.user = User(is_superuser=True)
+
+        actions = self.admin.get_actions(request)
+        assert "bulk_approve" in actions
+        assert "bulk_reject" in actions
+        assert "bulk_escalate" in actions
+
+
+class TestPhotoSubmissionAdmin(TestCase):
+    """Tests for PhotoSubmissionAdmin class."""
+
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.site = AdminSite()
+        self.admin = PhotoSubmissionAdmin(model=PhotoSubmission, admin_site=self.site)
+
+    def test_list_display_includes_preview(self):
+        """Verify photo preview is in list_display."""
+        assert "photo_preview" in self.admin.list_display
+
+    def test_list_select_related(self):
+        """Verify select_related is configured."""
+        assert "user" in self.admin.list_select_related
+        assert "content_type" in self.admin.list_select_related
+        assert "handled_by" in self.admin.list_select_related
+
+    def test_moderation_actions_registered(self):
+        """Verify moderation actions are registered."""
+        request = self.factory.get("/admin/")
+        request.user = User(is_superuser=True)
+
+        actions = self.admin.get_actions(request)
+        assert "bulk_approve" in actions
+        assert "bulk_reject" in actions
+
+
+class TestStateLogAdmin(TestCase):
+    """Tests for StateLogAdmin class."""
+
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.site = AdminSite()
+        # Note: StateLog is from django_fsm_log
+        from django_fsm_log.models import StateLog
+        self.admin = StateLogAdmin(model=StateLog, admin_site=self.site)
+
+    def test_readonly_permissions(self):
+        """Verify read-only permissions are set."""
+        request = self.factory.get("/admin/")
+        request.user = User(is_superuser=False)
+
+        assert self.admin.has_add_permission(request) is False
+        assert self.admin.has_change_permission(request) is False
+
+    def test_delete_permission_superuser_only(self):
+        """Verify delete permission is superuser only."""
+        request = self.factory.get("/admin/")
+
+        request.user = User(is_superuser=False)
+        assert self.admin.has_delete_permission(request) is False
+
+        request.user = User(is_superuser=True)
+        assert self.admin.has_delete_permission(request) is True
+
+    def test_list_select_related(self):
+        """Verify select_related is configured."""
+        assert "content_type" in self.admin.list_select_related
+        assert "by" in self.admin.list_select_related
+
+    def test_export_action_registered(self):
+        """Verify export audit trail action is registered."""
+        request = self.factory.get("/admin/")
+        request.user = User(is_superuser=True)
+
+        actions = self.admin.get_actions(request)
+        assert "export_audit_trail" in actions
+
+
+class TestHistoryEventAdmin(TestCase):
+    """Tests for HistoryEventAdmin class."""
+
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.site = AdminSite()
+        # Note: HistoryEventAdmin is designed for pghistory event models
+        # We test it with a mock model
+
+    def test_readonly_permissions(self):
+        """Verify read-only permissions are configured in the class."""
+        # Test the methods exist and return correct values
+        admin = HistoryEventAdmin
+
+        # Check that has_add_permission returns False
+        assert hasattr(admin, "has_add_permission")
+
+        # Check that has_change_permission returns False
+        assert hasattr(admin, "has_change_permission")
+
+
+class TestRegisteredModels(TestCase):
+    """Tests for models registered with moderation site."""
+
+    def test_edit_submission_registered(self):
+        """Verify EditSubmission is registered with moderation site."""
+        assert EditSubmission in moderation_site._registry
+
+    def test_photo_submission_registered(self):
+        """Verify PhotoSubmission is registered with moderation site."""
+        assert PhotoSubmission in moderation_site._registry
+
+    def test_state_log_registered(self):
+        """Verify StateLog is registered with moderation site."""
+        from django_fsm_log.models import StateLog
+        assert StateLog in moderation_site._registry