Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

inc/auth.php

@@ -3,21 +3,8 @@
  * Auth & session helper
  */
 
-/**
- * Whether the visitor reached us over HTTPS. TLS ends at the reverse proxy
- * (NPM or Caddy), so PHP itself only ever sees plain HTTP — trust the
- * proxy's X-Forwarded-Proto, but only from a private/loopback address so a
- * public client can't claim it.
- */
-function request_is_https(): bool {
-    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
-        return true;
-    }
-    $remote = $_SERVER['REMOTE_ADDR'] ?? '';
-    $fromProxy = filter_var($remote, FILTER_VALIDATE_IP)
-        && !filter_var($remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
-    return $fromProxy && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https';
-}
+require_once __DIR__ . '/security-headers.php';
+send_security_headers();
 
 if (session_status() === PHP_SESSION_NONE) {
     // Configure secure session cookie defaults. 'secure' follows the