Security hardening, code quality, and ESLint setup

- Remove production DB dump (db_backup_*.sql) and update.log from git tracking
- Add DB backups to .gitignore
- Replace all console.log/console.error with structured logger module
- Translate Dutch error messages to English (link-discord.ts)
- Remove dead code blocks (register-form.tsx false && pattern)
- Add ESLint flat config with TypeScript, React, Next.js, jsx-a11y, and security plugins
- Add Prettier config
- Add eslint-plugin-security for security-aware linting
- Fix all 119+ ESLint warnings across the codebase:
  - Resolve security/detect-object-injection with safe access patterns
  - Resolve security/detect-non-literal-fs-filename with path traversal validation
  - Replace <img> with next/image <Image> component
  - Remove unused variables and imports
  - Replace non-null assertions with proper type guards
  - Replace <a> with <Link> for internal navigation
  - Use next/script Script component for external scripts
- Fix setState-in-useEffect anti-patterns (navbar-color-picker, logo-generator, theme-switcher)
- Add lint and format scripts to package.json

All checks: typecheck ✓, tests 58/58 ✓, lint 0 errors 0 warnings ✓

src/components/site-header.tsx

@@ -1,5 +1,6 @@
 import { getTranslations } from "next-intl/server";
 import Link from "next/link";
+import Image from "next/image";
 import { auth } from "@/lib/auth";
 import { cached } from "@/lib/cache";
 import { prisma } from "@/lib/prisma";
@@ -7,14 +8,14 @@ import { siteSettings } from "@/lib/services/site-settings";
 
 export async function SiteHeader() {
   const t = await getTranslations("header");
-  const [session, hotelName, header, logo] = await Promise.all([
+  const [_session, hotelName, header, logo] = await Promise.all([
     auth(),
     siteSettings.get("hotel_name", "Atom"),
     siteSettings.get("cms_header", "/assets/images/background.png"),
     siteSettings.get("cms_logo", ""),
   ]);
 
-  let online = 0;
+  let online: number;
   try {
     online = await cached("online_count", 10_000, () =>
       prisma.user.count({ where: { online: "1" } }),
@@ -49,7 +50,7 @@ export async function SiteHeader() {
       <div className="relative flex flex-col items-center justify-center px-4 py-12 min-h-[18rem]">
         <Link href="/" className="transition-transform duration-300 hover:scale-105 mb-8">
           {logo ? (
-            <img className="drop-shadow-2xl block" src={logo} alt={hotelName ?? "Hotel"} style={{ maxHeight: 120 }} />
+            <Image className="drop-shadow-2xl block" src={logo} alt={hotelName ?? "Hotel"} width={200} height={120} style={{ maxHeight: 120, width: "auto", height: "auto" }} unoptimized />
           ) : (
             <h1
               className="text-center font-extrabold tracking-tight leading-none text-white"