fix(): fix Critical command injection vulnerability + cross-platform breakage in CCTV image proxy

[Arielpetit]

PR: Replace execSync/curl.exe with Native fetch in CCTV Image Proxy

Issue

The CCTV image proxy (src/app/api/cctv/proxy/route.ts:77) contained a critical command injection vulnerability and a cross-platform compatibility issue.

The curlFetch function executed a shell command using execSync:

const data = execSync(`curl.exe -s -k -L --max-time 10 "${url}"`, ...);

This introduced two separate problems:

1. Cross-platform breakage — curl.exe is the Windows binary name and does not exist on Linux, causing production deployments to fail.
2. Command injection — The user-controlled url was interpolated directly into a shell command, creating a command injection vulnerability.

---

Fix

Replaced the execSync/curl.exe implementation with the native asynchronous fetch API.

Changes include:

• Removed the child_process import.
• Added an async lenientFetch(url) helper built on fetch.
• Added request timeout handling via AbortController.
• Continued validating the request hostname against the existing ALLOWED_HOSTS allowlist before issuing the request, preventing SSRF.

---

Behavior

Scenario	Before	After
Valid allowed host (e.g. cdn.skylinewebcams.com)	Crashed on Linux (curl.exe not found)	✅ Returns proxied image (200)
Forbidden domain	Crashed before validation	✅ 403 {"error":"Forbidden domain: ..."}
Missing url parameter	N/A	✅ 400 {"error":"Missing url parameter"}
Invalid URL	N/A	✅ 400 {"error":"Invalid URL"}
Upstream timeout	Could hang indefinitely	✅ Times out after 12 seconds via AbortController

---

Files Changed

File	Changes	Why
src/app/api/cctv/proxy/route.ts	Removed execSync/child_process usage and replaced curlFetch() with async lenientFetch() using the native fetch API.	Eliminates command injection and enables the proxy to work correctly on Linux.

---

Verification

• ✅ npm test — 9 passed, 1 skipped
• ✅ npm run build — Compiled successfully
• ✅ Manual curl testing — Success path and all error cases verified

[Arielpetit]

@simplifaisoul @sam1am @javierpr0 Can you please review this PR?