Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

admin/users.js

@@ -9,10 +9,16 @@ const userModal = document.getElementById('modal-user');
 const passwordModal = document.getElementById('modal-password');
 const editModal = document.getElementById('modal-edit');
 
+// Escapes for both text and quoted-attribute positions. The old version
+// (textContent → innerHTML) didn't escape quotes, so a name like
+// The "Big" Burger broke out of an aria-label="..." attribute.
 function escapeHtml(text) {
-  const div = document.createElement('div');
-  div.textContent = text ?? '';
-  return div.innerHTML;
+  return String(text ?? '')
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
 }
 
 async function postForm(formData) {