chore: production-readiness audit fixes and linting cleanup

app/api/image/[id]/route.ts

@@ -64,8 +64,6 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     return NextResponse.json({ error: 'Asset not found' }, { status: 404 });
   }
 
-  console.log(`[Image API] ✅ Serving ${assetId} (${size}) - Type: ${result.contentType}`);
-
   const headers: Record<string, string> = {
     'Content-Type': result.contentType.includes('application/octet-stream')
       ? 'image/jpeg'
@@ -73,7 +71,6 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     // Images are immutable once uploaded to Immich — cache aggressively
     'Cache-Control': 'public, max-age=31536000, immutable',
     'X-RateLimit-Remaining': String(remaining),
-    'Access-Control-Allow-Origin': '*', // Allow cross-origin for lightbox
   };
 
   if (result.contentLength) {

app/api/og/route.tsx

@@ -12,8 +12,8 @@ import { getConfig } from '@/lib/config';
 
 export async function GET(request: NextRequest) {
   const { searchParams } = request.nextUrl;
-  const title = searchParams.get('title') || 'Gallery';
-  const subtitle = searchParams.get('subtitle') || '';
+  const title = (searchParams.get('title') || 'Gallery').slice(0, 200);
+  const subtitle = (searchParams.get('subtitle') || '').slice(0, 100);
   const { theme } = getConfig();
 
   return new ImageResponse(