security: fix vulnerabilities and update security hardening (2026-03-12)

Code security fixes:
- Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes
- Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection
- Added path traversal protection in Upload.js (resolved path boundary check)
- Removed unsafe-eval from CSP script-src directive
- Removed information disclosure in BuildMetaData error responses
- Removed unused child_process import in BuildMetaData.js

Version bump: 1.2.1-beta → 1.2.2-beta

routes/BuildMetaData.js

@@ -1,7 +1,6 @@
 const express = require('express');
 const router = express.Router();
 const os = require('os');
-const child_process = require('child_process');
 const packageJson = require('../package.json');
 const fs = require('fs');
 const path = require('path');
@@ -64,7 +63,7 @@ router.get('/', async (req, res) => {
     res.json(buildMetadata);
   } catch (error) {
     console.error('Error in /build-metadata: ', error);
-    res.status(500).send('Error in /build-metadata: ' + error.toString());
+    res.status(500).send('Internal server error');
   }
 });