Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

admin/hours.php

@@ -3,6 +3,8 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../inc/auth.php';
 require_once __DIR__ . '/../inc/assets.php';
+require_once __DIR__ . '/../inc/admin-head.php';
+require_once __DIR__ . '/../inc/admin-nav.php';
 require_once __DIR__ . '/../inc/hours.php';
 
 require_auth();
@@ -66,39 +68,11 @@ $justSaved = !$_POST && isset($_GET['saved']);
 <!doctype html>
 <html lang="en">
 
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Hours | The Old Fitz Admin</title>
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
-</head>
+<?php render_admin_head('Hours'); ?>
 
 <body>
 
-  <nav class="admin-nav">
-    <div class="container admin-nav-inner">
-      <a href="index.php" class="admin-brand">
-        <img src="../assets/knot.png" alt="" class="knot">
-        <span>The Old Fitz Admin</span>
-      </a>
-      <div class="admin-nav-links">
-        <a href="index.php">Announcements</a>
-        <a href="menu.php">Menu</a>
-        <?php if (($user['role'] ?? '') === 'admin'): ?>
-        <a href="users.php">Users</a>
-        <?php endif; ?>
-        <a href="hours.php" class="active">Hours</a>
-      </div>
-      <div class="admin-user">
-        <a href="../" target="_blank" rel="noopener">View Public Site ↗</a>
-        <a href="account.php" class="admin-account-link" title="My Account"><?= htmlspecialchars($user['username']) ?></a>
-        <a href="logout.php">Sign Out</a>
-      </div>
-    </div>
-  </nav>
+  <?php render_admin_nav($user, 'hours'); ?>
 
   <main class="dashboard-layout">
     <div class="container">
@@ -157,7 +131,7 @@ $justSaved = !$_POST && isset($_GET['saved']);
             </div>
           </div>
 
-          <p class="muted field-hint" style="margin-top: 1.25rem;">Leave "Kitchen Closes" blank on a day if the kitchen doesn't have a separate cutoff from the bar. Special closures (holidays, weather) are handled on the <a href="index.php">Announcements</a> page instead of here.</p>
+          <p class="muted field-hint hours-note">Leave "Kitchen Closes" blank on a day if the kitchen doesn't have a separate cutoff from the bar. Special closures (holidays, weather) are handled on the <a href="index.php">Announcements</a> page instead of here.</p>
 
           <div class="form-actions">
             <button type="submit" class="btn btn-primary">Save Hours</button>
@@ -171,7 +145,7 @@ $justSaved = !$_POST && isset($_GET['saved']);
             <span>👀 Public Site Preview</span>
           </h2>
         </div>
-        <p class="muted" style="margin-bottom: 1.25rem;">This is how the schedule above will read on the site once saved.</p>
+        <p class="muted hours-preview-intro">This is how the schedule above will read on the site once saved.</p>
 
         <div class="hours-preview">
           <div class="hours-preview-card">