security: fix vulnerabilities and update security hardening (2026-03-12)

Code security fixes:
- Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes
- Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection
- Added path traversal protection in Upload.js (resolved path boundary check)
- Removed unsafe-eval from CSP script-src directive
- Removed information disclosure in BuildMetaData error responses
- Removed unused child_process import in BuildMetaData.js

Version bump: 1.2.1-beta → 1.2.2-beta

routes/Dpanel/API/DeleteFolfder.js

@@ -129,9 +129,9 @@ function authenticateToken(req, res, next) {
             return res.status(401).json({ message: 'Unauthorized' });
         }
 
-        fs.readFile(path.join(__dirname, '../../../data', 'user.jso,'), 'utf8', (err, data) => {
+        fs.readFile(path.join(__dirname, '../../../data', 'user.json'), 'utf8', (err, data) => {
             if (err) {
-                console.error('Error reading user.jso,:', err);
+                console.error('Error reading user.json:', err);
                 return res.status(401).json({ message: 'Unauthorized' });
             }