fix(security): authorize site uploads and harden tokens, media and request identity

src/components/public/logo-generator.tsx

@@ -19,8 +19,10 @@ import { ContentCard } from "@/components/public/ui";
 
 export default function LogoGenerator({
 	initialText = "",
+	canSaveToSite = false,
 }: {
 	initialText?: string;
+	canSaveToSite?: boolean;
 }) {
 	const [text, setText] = useState(initialText);
 	const [styleName, setStyleName] = useState("habbo");
@@ -106,6 +108,7 @@ export default function LogoGenerator({
 	}, [safeText]);
 
 	const handleSave = useCallback(() => {
+		if (!canSaveToSite) return;
 		const canvas = canvasRef.current;
 		if (!canvas) return;
 		setSaveStatus("saving");
@@ -123,7 +126,7 @@ export default function LogoGenerator({
 				setTimeout(() => setSaveStatus("idle"), 3000);
 			});
 		}, "image/png");
-	}, []);
+	}, [canSaveToSite]);
 
 	const [zipping, setZipping] = useState(false);
 	const allFonts = useMemo(() => HABBO_FONT_GROUPS.flatMap((g) => g.fonts), []);
@@ -252,20 +255,22 @@ export default function LogoGenerator({
 					>
 						⬇️ Download PNG
 					</button>
-					<button
-						type="button"
-						className="btn btn-primary"
-						onClick={handleSave}
-						disabled={saveStatus === "saving" || !fontLoaded}
-					>
-						{saveStatus === "saving"
-							? "⏳ Saving..."
-							: saveStatus === "done"
-								? "✅ Saved!"
-								: saveStatus === "error"
-									? "❌ Error"
-									: "💾 Save as site logo"}
-					</button>
+					{canSaveToSite && (
+						<button
+							type="button"
+							className="btn btn-primary"
+							onClick={handleSave}
+							disabled={saveStatus === "saving" || !fontLoaded}
+						>
+							{saveStatus === "saving"
+								? "⏳ Saving..."
+								: saveStatus === "done"
+									? "✅ Saved!"
+									: saveStatus === "error"
+										? "❌ Error"
+										: "💾 Save as site logo"}
+						</button>
+					)}
 					<button
 						type="button"
 						className="btn btn-secondary"