Security hardening, code quality, and ESLint setup

- Remove production DB dump (db_backup_*.sql) and update.log from git tracking
- Add DB backups to .gitignore
- Replace all console.log/console.error with structured logger module
- Translate Dutch error messages to English (link-discord.ts)
- Remove dead code blocks (register-form.tsx false && pattern)
- Add ESLint flat config with TypeScript, React, Next.js, jsx-a11y, and security plugins
- Add Prettier config
- Add eslint-plugin-security for security-aware linting
- Fix all 119+ ESLint warnings across the codebase:
  - Resolve security/detect-object-injection with safe access patterns
  - Resolve security/detect-non-literal-fs-filename with path traversal validation
  - Replace <img> with next/image <Image> component
  - Remove unused variables and imports
  - Replace non-null assertions with proper type guards
  - Replace <a> with <Link> for internal navigation
  - Use next/script Script component for external scripts
- Fix setState-in-useEffect anti-patterns (navbar-color-picker, logo-generator, theme-switcher)
- Add lint and format scripts to package.json

All checks: typecheck ✓, tests 58/58 ✓, lint 0 errors 0 warnings ✓

src/actions/save-favicon.ts

@@ -23,11 +23,16 @@ export async function saveFavicon(formData: FormData): Promise<{ success: boolea
     };
     const ext = mimeExt[file.type] ?? "png";
     const filename = `favicon-${Date.now()}.${ext}`;
-    const dir = path.join(process.cwd(), FAVICON_DIR);
-    const filePath = path.join(dir, filename);
+    const baseDir = path.resolve(process.cwd(), FAVICON_DIR);
+    const filePath = path.resolve(baseDir, filename);
+    if (!filePath.startsWith(baseDir + path.sep)) {
+      return { success: false, error: "Invalid path" };
+    }
 
     const buffer = Buffer.from(await file.arrayBuffer());
-    await mkdir(dir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await mkdir(baseDir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     await writeFile(filePath, buffer);
 
     const url = `/api/media/favicon/${filename}`;
@@ -37,9 +42,13 @@ export async function saveFavicon(formData: FormData): Promise<{ success: boolea
     if (oldUrl && oldUrl.startsWith("/api/media/favicon/")) {
       const oldName = oldUrl.replace("/api/media/favicon/", "");
       if (!oldName.includes("..") && !oldName.includes("/")) {
-        try {
-          await unlink(path.join(dir, oldName));
-        } catch { /* ignore if file doesn't exist */ }
+        const oldPath = path.resolve(baseDir, oldName);
+        if (oldPath.startsWith(baseDir + path.sep)) {
+          try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            await unlink(oldPath);
+          } catch { /* ignore if file doesn't exist */ }
+        }
       }
     }
 
@@ -63,12 +72,16 @@ export async function deleteFavicon(): Promise<{ success: boolean; error?: strin
   try {
     const oldUrl = await siteSettings.get("cms_favicon");
     if (oldUrl && oldUrl.startsWith("/api/media/favicon/")) {
-      const dir = path.join(process.cwd(), FAVICON_DIR);
+      const baseDir = path.resolve(process.cwd(), FAVICON_DIR);
       const oldName = oldUrl.replace("/api/media/favicon/", "");
       if (!oldName.includes("..") && !oldName.includes("/")) {
-        try {
-          await unlink(path.join(dir, oldName));
-        } catch { /* ignore */ }
+        const oldPath = path.resolve(baseDir, oldName);
+        if (oldPath.startsWith(baseDir + path.sep)) {
+          try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            await unlink(oldPath);
+          } catch { /* ignore */ }
+        }
       }
     }