fix(security): resolve audit findings — logging, endpoints, contact details

- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
  script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
  including the privacy policy and terms pages

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/services/socket.service.ts

@@ -59,7 +59,7 @@ class SocketService {
     }
 
     // Extract base URL without /api/v1 path for Socket.io connection
-    const apiUrl = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';
+    const apiUrl = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001/api/v1';
     const baseUrl = apiUrl.replace(/\/api\/v1\/?$/, '');
 
     this.socket = io(baseUrl, {