fix(security): resolve audit findings — logging, endpoints, contact details

- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
  script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
  including the privacy policy and terms pages

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/layout.tsx

@@ -158,12 +158,15 @@ export default function RootLayout({
           <NotificationProvider />
           {children}
         </SessionProvider>
-        {/* Umami analytics — loaded after page becomes interactive */}
-        <Script
-          src="https://analytics.superlabs.co/script.js"
-          data-website-id="00e1ce31-e174-4519-8b59-63e8d4556b01"
-          strategy="afterInteractive"
-        />
+        {/* Umami analytics — set NEXT_PUBLIC_UMAMI_URL and NEXT_PUBLIC_UMAMI_WEBSITE_ID to enable */}
+        {process.env.NEXT_PUBLIC_UMAMI_URL &&
+          process.env.NEXT_PUBLIC_UMAMI_WEBSITE_ID && (
+            <Script
+              src={process.env.NEXT_PUBLIC_UMAMI_URL}
+              data-website-id={process.env.NEXT_PUBLIC_UMAMI_WEBSITE_ID}
+              strategy="afterInteractive"
+            />
+          )}
         {/* Microsoft Clarity */}
         {process.env.NEXT_PUBLIC_CLARITY_ID && (
           <Script id="ms-clarity" strategy="afterInteractive">