Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

collections/Media.ts

@@ -24,7 +24,10 @@ export const Media: CollectionConfig = {
   },
   upload: {
     staticDir: path.resolve(dirname, "..", "media"),
-    mimeTypes: ["image/jpeg", "image/png", "image/webp", "image/svg+xml"],
+    // SVG deliberately excluded: it can carry inline <script>/event-handler
+    // payloads that execute if the raw file is ever opened directly (not via
+    // <img>) — not currently needed by any part of the site.
+    mimeTypes: ["image/jpeg", "image/png", "image/webp"],
     imageSizes: [
       { name: "thumbnail", width: 400, position: "centre" },
       { name: "card", width: 800, position: "centre" },