v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/routes/admin/api/settings/logo.post.js

@@ -4,6 +4,7 @@ import { createError, readMultipartFormData } from 'h3'
 import sharp from 'sharp'
 import { requireAdminSession } from '../../../../utils/admin-auth'
 import { upsertMediaMetadataCategory } from '../../../../utils/media-library'
+import { getConfiguredUploadRoot } from '../../../../utils/upload-root'
 
 const allowedImageTypes = new Set(['image/jpeg', 'image/png', 'image/webp'])
 
@@ -87,7 +88,7 @@ export default defineEventHandler(async (event) => {
 
   const uploadBaseUrl = String(config.uploadDir || '/uploads').replace(/\/+$/g, '') || '/uploads'
   const publicBasePath = uploadBaseUrl.replace(/^\/+/, '')
-  const directoryPath = join(process.cwd(), 'public', publicBasePath, 'system')
+  const directoryPath = join(getConfiguredUploadRoot(publicBasePath), 'system')
   const assetSuffix = createSystemAssetSuffix()
   const logoFileName = `logo-${assetSuffix}.webp`
   const faviconFileName = `favicon-${assetSuffix}.png`