Fix security vulnerabilities and request handling bugs

- Move page cache out of the publicly served .bunext/public dir and hash cache keys
- Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries
- Enforce API body size limit while reading; keep req body readable for handlers
- Hide error messages from clients in production
- Escape inline script JSON; strip cookies from HMR payloads
- Only trust X-Forwarded-Proto with trust_proxy config
- Fix console race in SSR, dotted page paths, middleware rewrites,
  excluded path status, encoded static file names, symlinked dirs
- Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/server/handle-files.ts

@@ -14,7 +14,7 @@ export default async function ({ req }: Params): Promise<Response> {
     try {
         const is_dev = isDevelopment();
         const url = new URL(req.url);
-        const file_path = path.join(PUBLIC_DIR, url.pathname);
+        const file_path = path.join(PUBLIC_DIR, decodeURIComponent(url.pathname));
 
         if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
             return new Response("Forbidden", { status: 403 });