Fix remaining Snyk findings: XSS in validImageUrl, cipher integrity suppression

src/lib/auth/laravel-encrypter.ts

@@ -30,6 +30,7 @@ export class LaravelEncrypter {
   encrypt(value: string, serialize = true): string {
     const iv = randomBytes(16);
     const data = serialize ? phpSerializeString(value) : value;
+    // snyk:ignore:javascript/CipherWithNoIntegrity
     // AES-256-CBC is required for Laravel compatibility. Integrity is provided
     // by the HMAC-SHA256 MAC (verified by decrypt before any output is returned),
     // not by the cipher mode itself. Switching to GCM would break existing
@@ -55,6 +56,7 @@ export class LaravelEncrypter {
       throw new Error("The MAC is invalid.");
     }
     const iv = Buffer.from(json.iv, "base64");
+    // snyk:ignore:javascript/CipherWithNoIntegrity
     // AES-256-CBC required for Laravel compatibility; MAC already verified
     // above so padding-oracle / tampering is not a risk.
     const decipher = createDecipheriv("aes-256-cbc", this.key, iv);