Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

inc/admin-nav.php

@@ -0,0 +1,46 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Shared admin navigation bar. Every admin page calls
+ * render_admin_nav($user, '<key>') where it used to repeat the markup.
+ *
+ * $active is one of the ADMIN_NAV_LINKS keys, or 'account' for the
+ * My Account page (which highlights the username link instead).
+ */
+
+const ADMIN_NAV_LINKS = [
+	// key => [href, label, admin-only]
+	'announcements' => ['index.php', 'Announcements', false],
+	'menu' => ['menu.php', 'Menu', false],
+	'users' => ['users.php', 'Users', true],
+	'hours' => ['hours.php', 'Hours', false],
+];
+
+function render_admin_nav(array $user, string $active): void {
+	$isAdmin = ($user['role'] ?? '') === 'admin';
+	$current = static fn (string $key): string =>
+		$key === $active ? ' class="active" aria-current="page"' : '';
+	?>
+	<nav class="admin-nav">
+		<div class="container admin-nav-inner">
+			<a href="index.php" class="admin-brand">
+				<img src="../assets/knot.png" alt="" class="knot">
+				<span>The Old Fitz Admin</span>
+			</a>
+			<div class="admin-nav-links">
+				<?php foreach (ADMIN_NAV_LINKS as $key => [$href, $label, $adminOnly]): ?>
+					<?php if (!$adminOnly || $isAdmin): ?>
+						<a href="<?= $href ?>"<?= $current($key) ?>><?= $label ?></a>
+					<?php endif; ?>
+				<?php endforeach; ?>
+			</div>
+			<div class="admin-user">
+				<a href="../" target="_blank" rel="noopener">View Public Site ↗</a>
+				<a href="account.php" class="admin-account-link<?= $active === 'account' ? ' active' : '' ?>" title="My Account"<?= $active === 'account' ? ' aria-current="page"' : '' ?>><?= htmlspecialchars($user['username']) ?></a>
+				<a href="logout.php">Sign Out</a>
+			</div>
+		</div>
+	</nav>
+	<?php
+}