fix(security): implement file upload security enhancements

- Add path traversal protection with secureStatic middleware
- Implement proper MIME type validation for all file uploads
- Add content-based file validation (magic numbers)
- Create comprehensive fileSecurityUtils for secure file operations
- Update adminPhotos.js with enhanced validation
- Update adminSettings.js for secure logo/favicon uploads
- Addresses file upload vulnerabilities from security scan

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/server.js

@@ -105,14 +105,17 @@ const setCorsHeaders = (req, res, next) => {
   next();
 };
 
+// Import secure static middleware
+const secureStatic = require('./src/middleware/secureStatic');
+
 // Static file serving for photos (protected)
-app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, express.static(path.join(__dirname, 'storage/events/active')));
+app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/events/active')));
 
 // Static file serving for thumbnails (protected)
-app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, express.static(path.join(__dirname, 'storage/thumbnails')));
+app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/thumbnails')));
 
 // Static file serving for uploads (public - logos, favicons)
-app.use('/uploads', setCorsHeaders, express.static(path.join(__dirname, 'storage/uploads')));
+app.use('/uploads', setCorsHeaders, secureStatic(path.join(__dirname, 'storage/uploads')));
 
 // Health check endpoint
 app.get('/api/health', (req, res) => {