Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/routes/site-settings.ts

@@ -17,9 +17,20 @@ interface UserContext {
 const siteSettingsRouter = new Hono<{ Variables: { user: UserContext } }>();
 
 // Validation schema for updating site settings
+// Validate against the runtime's IANA timezone database (rejects arbitrary strings
+// that later get fed into Intl.DateTimeFormat on the frontend).
+const isValidTimezone = (tz: string): boolean => {
+  try {
+    Intl.DateTimeFormat('en-US', { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 const updateSiteSettingsSchema = z.object({
-  timezone: z.string().optional(),
-  siteName: z.string().optional(),
+  timezone: z.string().refine(isValidTimezone, { message: 'Invalid timezone' }).optional(),
+  siteName: z.string().max(255).optional(),
   siteDescription: z.string().optional().nullable(),
   siteDescriptionEs: z.string().optional().nullable(),
   contactEmail: z.string().email().optional().nullable().or(z.literal('')),