fix(security): resolve audit findings — logging, endpoints, contact details

- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
  script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
  including the privacy policy and terms pages

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/contact/page.tsx

@@ -31,7 +31,7 @@ interface ContactCta {
 const defaultContactDetails: ContactDetails = {
   title: 'Get In Touch',
   description: 'Have a question about a property or need assistance? Fill out the form below and our team will get back to you shortly.',
-  email: '123support@gmail.com',
+  email: 'support@re-quest.com',
   phone: '1234567890',
   phoneHours: 'Mon-Fri 9am-6pm',
   officeAddress: '123 Market Street',