fix: harden deploys and close top security holes after /events outage

Isolate next dev from production .next, add build-guard/atomic deploy/health
watchdog, error boundaries, and fix JWT startup, meetup leaks, media path
traversal, SVG/memory uploads, and JSON-LD escaping.

Co-authored-by: Cursor <cursoragent@cursor.com>

ops/systemd/bbe-site-healthcheck.service

@@ -0,0 +1,18 @@
+# Oneshot health probe for the BBE site, driven by bbe-site-healthcheck.timer.
+#
+# Runs as root so it can `systemctl restart bbe-frontend` when the site is down.
+#
+# Install:
+#   sudo cp ops/systemd/bbe-site-healthcheck.service /etc/systemd/system/
+#   sudo cp ops/systemd/bbe-site-healthcheck.timer   /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now bbe-site-healthcheck.timer
+
+[Unit]
+Description=Belgian Bitcoin Embassy — site health watchdog
+After=network.target bbe-frontend.service
+
+[Service]
+Type=oneshot
+ExecStart=/home/bbe/BelgianBitcoinEmbassy/scripts/healthcheck.sh
+SyslogIdentifier=bbe-healthcheck