v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/password.put.js

@@ -2,7 +2,8 @@ import bcrypt from 'bcrypt'
 import { createError, readBody } from 'h3'
 import { z } from 'zod'
 import { getUserByIdWithPassword, updateMemberPassword } from '../../repositories/member-repository'
-import { requireMemberSession } from '../../utils/member-auth'
+import { clearMemberSession, requireMemberSession } from '../../utils/member-auth'
+import { clearAdminSession } from '../../utils/admin-auth'
 
 const updatePasswordSchema = z.object({
   currentPassword: z.string().min(1),
@@ -15,7 +16,7 @@ const updatePasswordSchema = z.object({
  * @returns {Promise<{ ok: true }>} 변경 결과
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const parsedBody = updatePasswordSchema.safeParse(await readBody(event))
 
   if (!parsedBody.success) {
@@ -46,6 +47,8 @@ export default defineEventHandler(async (event) => {
     userId: session.userId,
     passwordHash: nextHash
   })
+  clearMemberSession(event)
+  clearAdminSession(event)
 
   return { ok: true }
 })