feat(catalog): store furniture bundles as .hab instead of .nitro

Every bundle the CMS writes — upload, clone, sync, repair and the pet /
effect / figure importers — now lands as `<classname>.hab`, the extension
this deployment's renderer asks for. `.hab` and `.nitro` are the same
container, so an upload of either extension is accepted.

Resolution goes through one module, src/lib/furni/bundle-file.ts, so
nothing has to know the extension twice. Every existence check probes
`.hab` first and falls back to `.nitro`: the on-disk asset set is still
predominantly `.nitro`, and without the fallback Studio would report every
imported item as missing and the cleanup scan would classify 18k live
bundles as fake leftovers. Downloads are unchanged — Habbo's CDN and every
configured clone source still serve `.nitro`, so the conversion happens on
write, not on request.

Deliberately unchanged: the staged-attachment store in furni-attachment.ts
keys on a UUID and never reaches the client, so renaming it would break
in-flight recovery jobs.

Adds scripts/migrate-nitro-to-hab.ts to rename the existing asset set. It
refuses to run without --dry-run or --yes, never overwrites an existing
.hab, never deletes, and is idempotent.

Note: renderer-config.json lives outside this repo and was patched to
.hab separately; that file is served with a 30-day max-age, so returning
clients need a cms-client cache purge to pick the change up.

src/lib/services/nitro-cleanup.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { stripBundleExt } from "@/lib/furni/bundle-file";
 import {
 	DEFAULT_NITRO_SOURCES,
 	listSources,
@@ -105,7 +106,11 @@ export interface NitroAutoCleanResult extends NitroCleanupDeleteResult {
 	skippedBroken: number;
 }
 
-const NITRO_FILE_RE = /^[a-z0-9_*\-.]+\.nitro$/i;
+// Both bundle extensions: `.hab` is what imports write today, `.nitro` is the
+// legacy name still covering the bulk of the on-disk asset set. Both must be
+// scanned — matching only one would leave the other invisible to the fake /
+// broken classification and to the nightly auto-clean.
+const NITRO_FILE_RE = /^[a-z0-9_*\-.]+\.(?:nitro|hab)$/i;
 const SWF_FILE_RE = /^[a-z0-9_*\-.]+\.swf$/i;
 const ICON_FILE_RE = /^[a-z0-9_*\-.]+\.(?:gif|png)$/i;
 
@@ -795,14 +800,20 @@ export async function repairBrokenNitros(
 
 	await runPool(uniqueFileNames, 6, async (rawName) => {
 		const fileName = String(rawName ?? "");
-		if (!NITRO_FILE_RE.test(fileName) || !fileName.endsWith(".nitro")) {
+		// `stripBundleExt` only peels the extension — it does not make the stem
+		// safe to join into a path. The character-class regex is what rejects
+		// traversal payloads like `../evil.nitro` before any download runs.
+		const name =
+			NITRO_FILE_RE.test(fileName) && stripBundleExt(fileName) !== null
+				? stripBundleExt(fileName)
+				: null;
+		if (name === null) {
 			const message = `Invalid nitro file name: ${fileName}`;
 			errors.push(message);
 			files.push({ fileName, ok: false, error: message });
 			finish(fileName, false, message);
 			return;
 		}
-		const name = fileName.slice(0, -".nitro".length);
 		const candidates = [
 			name,
 			...(name.includes("*")