fix: harden deploys and close top security holes after /events outage

Isolate next dev from production .next, add build-guard/atomic deploy/health
watchdog, error boundaries, and fix JWT startup, meetup leaks, media path
traversal, SVG/memory uploads, and JSON-LD escaping.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/middleware/auth.ts

@@ -30,17 +30,23 @@ export async function requireAuth(req: Request, res: Response, next: NextFunctio
   const token = header.slice(7);
 
   // API keys authenticate programmatic clients. They carry their own scoped
-  // permission set rather than a role, so we pre-resolve access here.
+  // permission set rather than a role, so we pre-resolve access here. Wrapped in
+  // try/catch because Express 4 does not catch rejections from async middleware.
   if (looksLikeApiKey(token)) {
-    const access = await resolveApiKey(token);
-    if (!access) {
-      res.status(401).json({ error: 'Invalid or revoked API key' });
-      return;
+    try {
+      const access = await resolveApiKey(token);
+      if (!access) {
+        res.status(401).json({ error: 'Invalid or revoked API key' });
+        return;
+      }
+      req.user = { pubkey: access.pubkey, role: 'apikey' };
+      req.access = access;
+      req.isApiKey = true;
+      next();
+    } catch (err) {
+      console.error('API key resolution error:', err);
+      res.status(500).json({ error: 'Internal server error' });
     }
-    req.user = { pubkey: access.pubkey, role: 'apikey' };
-    req.access = access;
-    req.isApiKey = true;
-    next();
     return;
   }