Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

scripts/build-dist.js

@@ -74,6 +74,25 @@ if (fs.existsSync(dbHtaccess)) {
   missing.push('db/.htaccess');
 }
 
+// Normalize permissions: 755 for directories, 644 for files. Copies keep
+// the source file's mode, so a file that's owner-only on the dev machine
+// (e.g. after an in-place edit) would ship unreadable to Apache's
+// www-data and 500 the page. Forcing the modes here means local
+// permissions can never break a deploy.
+function normalizePermissions(dir) {
+  fs.chmodSync(dir, 0o755);
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      normalizePermissions(full);
+    } else {
+      fs.chmodSync(full, 0o644);
+    }
+  }
+}
+
+normalizePermissions(DIST);
+
 if (missing.length) {
   console.warn('Warning: expected but not found, skipped:\n  ' + missing.join('\n  '));
 }