fix(security): resolve audit findings — debug log, payment bypass, images

- Remove the committed firebase-debug.log (contains a personal Google
  account) and gitignore it. NOTE: still present in history — a history
  rewrite or written confirmation is still outstanding
- Remove the client-side skipPaymentCheck approval bypass
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -29,6 +29,7 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 .pnpm-debug.log*
+firebase-debug.log*
 
 # env files (can opt-in for committing if needed)
 .env*