fix(security): resolve audit findings — logging, endpoints, contact details

- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
  script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
  including the privacy policy and terms pages

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/(user)/user/settings/password/page.tsx

@@ -3,8 +3,8 @@
 import { SettingsSidebar, PasswordSecurityForm } from '@/components/settings';
 
 export default function UserPasswordSecurityPage() {
-  const handleSave = (data: { currentPassword: string; newPassword: string }) => {
-    console.log('Updating user password:', data);
+  const handleSave = (_data: { currentPassword: string; newPassword: string }) => {
+    // TODO: call the change-password API. Do not log password payloads.
   };
 
   return (