v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/reconcile-media-catalog.js

@@ -0,0 +1,40 @@
+import postgres from 'postgres'
+
+const databaseUrl = String(process.env.DATABASE_URL || '').trim()
+
+if (!databaseUrl) {
+  throw new Error('DATABASE_URL_REQUIRED')
+}
+
+const parsedDatabaseUrl = new URL(databaseUrl)
+const allowedHosts = new Set(['127.0.0.1', 'localhost', '::1'])
+const expectedDatabase = decodeURIComponent(parsedDatabaseUrl.pathname.replace(/^\/+/, ''))
+
+if (process.env.NODE_ENV === 'production' || !allowedHosts.has(parsedDatabaseUrl.hostname)) {
+  throw new Error('MEDIA_CATALOG_RECONCILE_LOCAL_DATABASE_ONLY')
+}
+
+const database = postgres(databaseUrl, {
+  max: 1
+})
+
+try {
+  const identityRows = await database`
+    SELECT current_database() AS database_name
+  `
+  const databaseName = identityRows[0]?.database_name
+
+  if (!databaseName || databaseName !== expectedDatabase || /prod|production/i.test(databaseName)) {
+    throw new Error('MEDIA_CATALOG_DATABASE_IDENTITY_MISMATCH')
+  }
+
+  const { reconcileMediaCatalog } = await import('../server/repositories/media-catalog-repository.js')
+  const report = await reconcileMediaCatalog()
+  console.info(JSON.stringify({
+    database: databaseName,
+    destructiveFileChanges: false,
+    report
+  }, null, 2))
+} finally {
+  await database.end()
+}