v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/utils/member-avatar-upload.js

@@ -2,6 +2,7 @@ import { mkdir, stat, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { createError, readMultipartFormData } from 'h3'
 import sharp from 'sharp'
+import { getConfiguredUploadRoot } from './upload-root'
 
 const allowedImageTypes = new Map([
   ['image/jpeg', '.jpg'],
@@ -134,7 +135,7 @@ export const uploadMemberAvatarImage = async (event) => {
   const month = String(now.getMonth() + 1).padStart(2, '0')
   const uploadBaseUrl = String(config.uploadDir || '/uploads').replace(/\/+$/g, '') || '/uploads'
   const publicBasePath = uploadBaseUrl.replace(/^\/+/, '')
-  const directoryPath = join(process.cwd(), 'public', publicBasePath, 'members', 'avatars', year, month)
+  const directoryPath = join(getConfiguredUploadRoot(publicBasePath), 'members', 'avatars', year, month)
 
   await mkdir(directoryPath, { recursive: true })