chore: production-readiness audit fixes and linting cleanup

app/[...path]/PhotoGrid.tsx

@@ -55,6 +55,9 @@ export function PhotoGrid({ assets, layout = 'masonry', gridStyle }: PhotoGridPr
   useEffect(() => {
     const idx = parsePhotoHash(window.location.hash);
     if (idx !== null && idx < assets.length) {
+      // state from URL hash on mount only (equivalent to useState lazy initializer for
+      // client-only browser APIs).
+      // eslint-disable-next-line react-hooks/set-state-in-effect
       setLightboxIndex(idx);
     }
   }, [assets.length]);
@@ -139,8 +142,9 @@ export function PhotoGrid({ assets, layout = 'masonry', gridStyle }: PhotoGridPr
         {assets.map((asset, index) => (
           <FadeIn key={asset.id} delay={index < 12 ? index * 50 : 0}>
             <div
-              className={`photo-grid__item${layout === 'showcase' && index === 0 ? ' photo-grid__featured' : ''
-                }`}
+              className={`photo-grid__item${
+                layout === 'showcase' && index === 0 ? ' photo-grid__featured' : ''
+              }`}
               onClick={() => openLightbox(index)}
               onKeyDown={(e) => {
                 if (e.key === 'Enter' || e.key === ' ') {

app/[...path]/page.tsx

@@ -288,11 +288,7 @@ export default async function PathPage({ params }: PathPageProps) {
           {album.description && ` · ${album.description}`}
         </p>
       </div>
-      <PhotoGrid
-        assets={images}
-        layout={resolveLayout()}
-        gridStyle={buildGridStyle()}
-      />
+      <PhotoGrid assets={images} layout={resolveLayout()} gridStyle={buildGridStyle()} />
     </>
   );
 }

app/api/image/[id]/route.ts

@@ -64,8 +64,6 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     return NextResponse.json({ error: 'Asset not found' }, { status: 404 });
   }
 
-  console.log(`[Image API] ✅ Serving ${assetId} (${size}) - Type: ${result.contentType}`);
-
   const headers: Record<string, string> = {
     'Content-Type': result.contentType.includes('application/octet-stream')
       ? 'image/jpeg'
@@ -73,7 +71,6 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     // Images are immutable once uploaded to Immich — cache aggressively
     'Cache-Control': 'public, max-age=31536000, immutable',
     'X-RateLimit-Remaining': String(remaining),
-    'Access-Control-Allow-Origin': '*', // Allow cross-origin for lightbox
   };
 
   if (result.contentLength) {

app/api/og/route.tsx

@@ -12,8 +12,8 @@ import { getConfig } from '@/lib/config';
 
 export async function GET(request: NextRequest) {
   const { searchParams } = request.nextUrl;
-  const title = searchParams.get('title') || 'Gallery';
-  const subtitle = searchParams.get('subtitle') || '';
+  const title = (searchParams.get('title') || 'Gallery').slice(0, 200);
+  const subtitle = (searchParams.get('subtitle') || '').slice(0, 100);
   const { theme } = getConfig();
 
   return new ImageResponse(