fix: harden deploys and close top security holes after /events outage

Isolate next dev from production .next, add build-guard/atomic deploy/health
watchdog, error boundaries, and fix JWT startup, meetup leaks, media path
traversal, SVG/memory uploads, and JSON-LD escaping.

Co-authored-by: Cursor <cursoragent@cursor.com>

ops/systemd/bbe-frontend.service.d/verify-build.conf

@@ -0,0 +1,15 @@
+# Drop-in override for bbe-frontend.service.
+#
+# Refuses to (re)start the frontend when the .next production build is missing or
+# has been contaminated by a `next dev` run, so we fail loudly at boot instead of
+# silently serving 500s on every request-time route (e.g. /events).
+#
+# Install:
+#   sudo mkdir -p /etc/systemd/system/bbe-frontend.service.d
+#   sudo cp ops/systemd/bbe-frontend.service.d/verify-build.conf \
+#           /etc/systemd/system/bbe-frontend.service.d/verify-build.conf
+#   sudo systemctl daemon-reload
+#   sudo systemctl restart bbe-frontend
+
+[Service]
+ExecStartPre=/home/bbe/BelgianBitcoinEmbassy/frontend/scripts/verify-prod-build.sh

ops/systemd/bbe-site-healthcheck.service

@@ -0,0 +1,18 @@
+# Oneshot health probe for the BBE site, driven by bbe-site-healthcheck.timer.
+#
+# Runs as root so it can `systemctl restart bbe-frontend` when the site is down.
+#
+# Install:
+#   sudo cp ops/systemd/bbe-site-healthcheck.service /etc/systemd/system/
+#   sudo cp ops/systemd/bbe-site-healthcheck.timer   /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now bbe-site-healthcheck.timer
+
+[Unit]
+Description=Belgian Bitcoin Embassy — site health watchdog
+After=network.target bbe-frontend.service
+
+[Service]
+Type=oneshot
+ExecStart=/home/bbe/BelgianBitcoinEmbassy/scripts/healthcheck.sh
+SyslogIdentifier=bbe-healthcheck

ops/systemd/bbe-site-healthcheck.timer

@@ -0,0 +1,13 @@
+# Fires the BBE site health watchdog every 5 minutes.
+
+[Unit]
+Description=Run BBE site health watchdog every 5 minutes
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Unit=bbe-site-healthcheck.service
+
+[Install]
+WantedBy=timers.target