feat(security+obs): SSRF allowlist, HTML sanitization, timing-safe tokens, fetch timeouts, structured logger

Security:
  - cms-images / cms-files now share resolveCmsSource (cms-source.server.ts)
    which enforces an allowlist: asset filename, absolute path on the CMS
    host, or full URL exact-matching the configured CMS host+protocol.
    Foreign hosts, protocol-relative URLs and path traversal return 400.
  - markdown-safe.ts is the single configured marked entrypoint; it
    disables raw HTML rendering globally (renderer.html() returns ''),
    removing the inline script/iframe injection vector via markdown.
    All 8 marked imports across components and loaders now go through it.
  - sanitize-blocks.server.ts walks resolved page/post content and runs
    HtmlBlock html fields through sanitize-html with a tight allowlist
    (no script/style/on*, only youtube/vimeo/spotify iframes, mailto/tel
    plus http(s) schemes, target=_blank gets rel=noopener).
  - Webhook tokens (revalidate, cache/clear) compared via
    crypto.timingSafeEqual through auth-token.server.ts.
  - cms.ts wraps every fetch in cmsFetch(): 5 s default timeout via
    AbortSignal.timeout, override per call or globally via
    PUBLIC_CMS_FETCH_TIMEOUT_MS. Stops slow CMS responses from pinning
    SSR workers indefinitely.

Observability:
  - log.server.ts gives logWarn / logError / logInfo with scope + context;
    swallowed catch {} blocks in hooks, layout.server, +page.server,
    [...slug]/+page.server and sitemap now log instead of going silent.

Routing:
  - Legacy /blog, /blog/page/:n, /blog/tag/:t and /p/:slug stub routes
    deleted; their 301 redirects moved into hooks.server.ts so the
    request never enters the SvelteKit page pipeline.

Tests (vitest, server-side):
  - auth-token.server.test.ts (6 cases for constant-time compare)
  - cms-source.server.test.ts  (8 cases for SSRF allowlist)
  - sanitize-blocks.server.test.ts (9 cases for sanitizer + walker)
  All 23 green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/cms-images/+server.ts

@@ -1,36 +1,16 @@
 import type { RequestHandler } from './$types';
-import { env } from '$env/dynamic/public';
 import {
   buildCacheKey,
   getCachedImage,
   cacheImage,
   type ImageTransformParams,
 } from '$lib/image-cache.server';
+import { getCmsBaseUrl, resolveCmsSource } from '$lib/cms-source.server';
 
 const IMMUTABLE_HEADERS = {
   'cache-control': 'public, max-age=31536000, immutable',
 } as const;
 
-function getCmsBaseUrl(): string {
-  return (
-    env.PUBLIC_CMS_URL ||
-    import.meta.env.PUBLIC_CMS_URL ||
-    'http://localhost:3000'
-  ).replace(/\/$/, '');
-}
-
-/**
- * Wenn src kein vollständiger URL ist, wird er als CMS-Asset-Dateiname behandelt
- * und zu {CMS_URL}/api/assets/{src} aufgelöst.
- * Absolute Pfade (z.B. /api/assets/logo/logo3.svg) werden direkt an die CMS-URL angehängt.
- */
-function resolveSourceUrl(src: string): string {
-  if (src.startsWith('http://') || src.startsWith('https://')) return src;
-  if (src.startsWith('//')) return `https:${src}`;
-  if (src.startsWith('/')) return `${getCmsBaseUrl()}${src}`;
-  return `${getCmsBaseUrl()}/api/assets/${encodeURIComponent(src)}`;
-}
-
 /**
  * Pick output format based on client Accept header.
  * Priority: avif > webp > jpeg. Used when `format=auto` is requested so the
@@ -102,7 +82,10 @@ export const GET: RequestHandler = async ({ url, request }) => {
     });
   }
 
-  const sourceUrl = resolveSourceUrl(src);
+  const sourceUrl = resolveCmsSource(src);
+  if (!sourceUrl) {
+    return new Response('Source not allowed', { status: 400 });
+  }
   const cmsBase = getCmsBaseUrl();
   const transformParams = new URLSearchParams();
   transformParams.set('url', sourceUrl);