Security fixes: Remove PAT, add idempotency, fix admin auth

- Remove exposed GitHub PAT from git remote URL
- Remove admin password plaintext fallback (bcrypt only)
- Add webhook idempotency protection to prevent duplicate payments
- Fix webhook error handling to return 500 on errors (enables retry)
- Upgrade archiver to v7 to fix npm vulnerabilities
- Add production environment validation for critical secrets
- Add comprehensive security review documentation

chat/package.json

@@ -15,7 +15,7 @@
   "type": "commonjs",
   "dependencies": {
     "adm-zip": "^0.5.16",
-    "archiver": "^6.0.1",
+    "archiver": "^7.0.1",
     "bcrypt": "^6.0.0",
     "jsonwebtoken": "^9.0.2",
     "pdfkit": "^0.17.2",