feat: Add photo management features, duplicate detection, attempt limits, and admin deletion

- Add duplicate photo detection (file hash and URL checking)
- Add max attempts per photo with UI counter
- Simplify penalty system (auto-enable when points > 0)
- Prevent scores from going below 0
- Add admin photo deletion functionality
- Improve navigation with always-visible logout
- Prevent users from guessing their own photos

__tests__/components/Navigation.test.tsx

@@ -0,0 +1,73 @@
+import { render, screen } from '@testing-library/react'
+import { useSession } from 'next-auth/react'
+import Navigation from '@/components/Navigation'
+
+jest.mock('next-auth/react')
+
+describe('Navigation', () => {
+  it('should not render when user is not logged in', () => {
+    ;(useSession as jest.Mock).mockReturnValue({
+      data: null,
+      status: 'unauthenticated',
+    })
+
+    const { container } = render(<Navigation />)
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('should render navigation when user is logged in', () => {
+    ;(useSession as jest.Mock).mockReturnValue({
+      data: {
+        user: {
+          name: 'Test User',
+          email: 'test@example.com',
+          role: 'USER',
+        },
+      },
+      status: 'authenticated',
+    })
+
+    render(<Navigation />)
+    
+    expect(screen.getByText('MirrorMatch')).toBeInTheDocument()
+    expect(screen.getByText('Photos')).toBeInTheDocument()
+    expect(screen.getByText('Upload')).toBeInTheDocument()
+    expect(screen.getByText('Leaderboard')).toBeInTheDocument()
+    expect(screen.getByText('Profile')).toBeInTheDocument()
+    expect(screen.getByText('Hello, Test User')).toBeInTheDocument()
+  })
+
+  it('should show admin link for ADMIN users', () => {
+    ;(useSession as jest.Mock).mockReturnValue({
+      data: {
+        user: {
+          name: 'Admin User',
+          email: 'admin@example.com',
+          role: 'ADMIN',
+        },
+      },
+      status: 'authenticated',
+    })
+
+    render(<Navigation />)
+    
+    expect(screen.getByText('Admin')).toBeInTheDocument()
+  })
+
+  it('should not show admin link for regular users', () => {
+    ;(useSession as jest.Mock).mockReturnValue({
+      data: {
+        user: {
+          name: 'Test User',
+          email: 'test@example.com',
+          role: 'USER',
+        },
+      },
+      status: 'authenticated',
+    })
+
+    render(<Navigation />)
+    
+    expect(screen.queryByText('Admin')).not.toBeInTheDocument()
+  })
+})

__tests__/lib/utils.test.ts

@@ -0,0 +1,65 @@
+import { hashPassword, normalizeString } from '@/lib/utils'
+import bcrypt from 'bcryptjs'
+
+describe('lib/utils', () => {
+  describe('hashPassword', () => {
+    it('should hash a password', async () => {
+      const password = 'testpassword123'
+      const hash = await hashPassword(password)
+      
+      expect(hash).toBeDefined()
+      expect(hash).not.toBe(password)
+      expect(hash.length).toBeGreaterThan(0)
+    })
+
+    it('should produce different hashes for the same password', async () => {
+      const password = 'testpassword123'
+      const hash1 = await hashPassword(password)
+      const hash2 = await hashPassword(password)
+      
+      // Hashes should be different (due to salt)
+      expect(hash1).not.toBe(hash2)
+      
+      // But both should verify correctly
+      expect(await bcrypt.compare(password, hash1)).toBe(true)
+      expect(await bcrypt.compare(password, hash2)).toBe(true)
+    })
+
+    it('should verify passwords correctly', async () => {
+      const password = 'testpassword123'
+      const hash = await hashPassword(password)
+      
+      expect(await bcrypt.compare(password, hash)).toBe(true)
+      expect(await bcrypt.compare('wrongpassword', hash)).toBe(false)
+    })
+  })
+
+  describe('normalizeString', () => {
+    it('should trim whitespace', () => {
+      expect(normalizeString('  test  ')).toBe('test')
+      expect(normalizeString('  test')).toBe('test')
+      expect(normalizeString('test  ')).toBe('test')
+    })
+
+    it('should convert to lowercase', () => {
+      expect(normalizeString('TEST')).toBe('test')
+      expect(normalizeString('TeSt')).toBe('test')
+      expect(normalizeString('Test Name')).toBe('test name')
+    })
+
+    it('should handle empty strings', () => {
+      expect(normalizeString('')).toBe('')
+      expect(normalizeString('   ')).toBe('')
+    })
+
+    it('should handle special characters', () => {
+      expect(normalizeString('  Test-Name  ')).toBe('test-name')
+      expect(normalizeString('John Doe')).toBe('john doe')
+    })
+
+    it('should handle mixed case with spaces', () => {
+      expect(normalizeString('  JOHN DOE  ')).toBe('john doe')
+      expect(normalizeString('jOhN dOe')).toBe('john doe')
+    })
+  })
+})