fix(security): resolve audit findings — debug log, payment bypass, images

- Remove the committed firebase-debug.log (contains a personal Google
  account) and gitignore it. NOTE: still present in history — a history
  rewrite or written confirmation is still outstanding
- Remove the client-side skipPaymentCheck approval bypass
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

next.config.ts

@@ -7,10 +7,9 @@ const nextConfig: NextConfig = {
   // Image optimization
   images: {
     remotePatterns: [
-      {
-        protocol: "https",
-        hostname: "**",
-      },
+      { protocol: "https", hostname: "*.contabostorage.com" },
+      { protocol: "https", hostname: "*.amazonaws.com" },
+      { protocol: "https", hostname: "*.digitaloceanspaces.com" },
     ],
   },
 };