Security hardening aligned with current main

[EdmundLimBoEn]

What changed

• rebuilds the security hardening on the current canonical main instead of the fork's 28-commit-stale application structure
• makes forum creation and moderator assignment server-enforced admin operations
• binds authored content, reports, moderation records, and activity records to the authenticated OIDC user's profile
• makes identity fields immutable and limits user-owned profile mutations
• adds server- and client-side size/count limits for forums, posts, comments, reports, and attachments
• blocks unsafe external URL schemes in markdown, previews, and attachment links
• adds safer hosting cache, MIME-sniffing, referrer, and browser-permission headers
• refreshes non-breaking transitive dependency versions in the lockfile

Why

PR #2 was based on the old root-level JavaScript app. Canonical main has since moved to an Expo Router TypeScript app with portal OIDC and was 28 commits ahead of the fork base. Cherry-picking the old patch would reintroduce deleted files and obsolete client-side password handling. This PR carries the security intent forward without regressing the current authentication architecture.

Validation

• npx tsc --noEmit
• Firestore rules parsed by the Firebase Firestore emulator
• Storage rules parsed by the Firebase Storage emulator
• npm run build:web with non-secret dummy Firebase build configuration
• git diff --check

Follow-up

npm audit still reports advisories whose automated fixes require major Expo and Firebase upgrades, plus a markdown parser advisory with no upstream fix. Those upgrades should be handled separately because forcing them here would be a broad framework migration.

Supersedes #2.