chore: clean up codebase for production readiness

- Remove all console.log/debug statements from production code
- Add NODE_ENV checks for development-only logging
- Remove test scripts (test-feedback, test-image-security, test-backup-*, test-restore)
- Remove one-time fix scripts (fix-temp-photos, fix-migration-state, mark-migration-applied)
- Remove sensitive files (.env.backup, ADMIN_CREDENTIALS.txt)
- Update package.json to remove references to deleted scripts
- Replace console statements with logger utility in backend
- Secure error boundaries to not expose stack traces in production

This makes the codebase production-ready with no debug output or test scripts.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/feedbackRateLimit.js

@@ -24,7 +24,10 @@ async function getRateLimitSettings() {
       .first();
     
     if (settings && settings.setting_value) {
-      return JSON.parse(settings.setting_value);
+      // setting_value is already a JSON object in PostgreSQL
+      return typeof settings.setting_value === 'string' 
+        ? JSON.parse(settings.setting_value)
+        : settings.setting_value;
     }
     
     // Default settings
@@ -120,8 +123,8 @@ async function recordAction(identifier, eventId, actionType) {
 function feedbackRateLimit(actionType) {
   return async (req, res, next) => {
     try {
-      // Extract event ID from params or body
-      const eventId = req.params.eventId || req.body?.event_id;
+      // Extract event ID from params, body or event object (set by verifyGalleryAccess)
+      const eventId = req.params.eventId || req.body?.event_id || req.event?.id;
       if (!eventId) {
         return res.status(400).json({ error: 'Event ID required' });
       }