refactor: full codebase audit — extract modules, fix type safety, clean dead code

- Extract API helpers from UploadZone into lib/upload-api.ts (FormData builder, checkFolderDiffs, uploadDrive, uploadGit)
- Extract upload orchestration into hooks/useUploadOrchestrator.ts (UploadZone: 489 → 162 lines)
- Extract file diff classification into lib/diff-files.ts (from git route)
- Extract shared SVG icons into components/ui/icons.tsx (7 icons, 0 duplication)
- Extract shared modal wrapper into components/ui/Modal.tsx + ModalActions
- Extract DriveStatusLine sub-component from FolderCard
- Fix checkFolderDiffs silently swallowing auth/network errors (now throws)
- Fix type safety: remove as never casts, add isHttpError type guard, use discriminated union for validateFolder
- Fix nextcloud: cache getConfig, add max bound to findNextVersion, optimize mkdirRecursive (skip PROPFIND)
- Fix drive route: remove req.clone(), extend parseMultiUpload to return extra fields
- Fix commit message: model shown as unchanged with ↔️ on updates (not falsely marked as modified)
- Clean dead code: unused folderExists import, FileStatus/DriveStatus exports, ParsedFile.textureName, getConfig basePath
- Add security headers in next.config.ts (HSTS, X-Content-Type-Options, X-Frame-Options, etc.)
- Update README with new project structure

README.md

@@ -144,11 +144,13 @@ update: upload-gltf add a new model -> farm/my-model
 ```
 update: upload-gltf update -> general/coffeetest
 
+📦 Model
+  ↔️ model.gltf (inchange)
 🎨 Textures
   🔄 metalness.jpg
 ```
 
-Symbols: `✅` new — `🔄` modified — `❌` missing or deleted
+Symbols: `✅` new — `🔄` modified — `↔️` unchanged (model always re-pushed) — `❌` missing or deleted
 
 8. Orphan files (present on remote but not in the new upload) are deleted in the same commit
 9. If Blender is unavailable, the original model is pushed as-is (graceful fallback)
@@ -178,34 +180,41 @@ app/
 ├── layout.tsx             # Root layout (next/font/google)
 └── page.tsx               # Home page
 components/
+├── ui/
+│   ├── icons.tsx              # Shared SVG icon components
+│   └── Modal.tsx              # Shared modal wrapper + ModalActions
 ├── upload/
 │   ├── SecretInput.tsx        # Access key input
 │   ├── DestinationPicker.tsx  # Destination selector
 │   ├── FolderDropzone.tsx     # Folder drag & drop / picker
 │   ├── FolderCard.tsx         # Folder status card (Drive + Git)
+│   ├── DriveStatusLine.tsx    # Drive/Git status sub-line
 │   ├── WarningBanner.tsx      # Missing texture warnings
 │   ├── OverwriteConfirmModal.tsx  # Diff confirmation dialog
 │   ├── NoChangesModal.tsx     # "No changes detected" dialog
 │   ├── DriveErrorModal.tsx    # "Drive failed, continue?" dialog
 │   └── ActionButtons.tsx      # Upload / Cancel / Reset buttons
-├── UploadZone.tsx         # Main orchestrator (Drive → Git flow)
+├── UploadZone.tsx         # Main upload page (rendering only)
 ├── ModelViewer.tsx        # Lazy wrapper for 3D viewer
 └── SceneViewer.tsx        # Three.js Canvas
 hooks/
-├── useSecret.ts           # Secret key state management
-└── useFolderEntries.ts    # Folder entries state management
+├── useSecret.ts               # Secret key state management
+├── useFolderEntries.ts        # Folder entries state management
+└── useUploadOrchestrator.ts   # Upload pipeline orchestration (Drive → Git)
 lib/
 ├── constants.ts           # Shared constants, destinations, extensions
 ├── types.ts               # Server types (ParsedFile, FileDiff, etc.)
 ├── client-types.ts        # Client types (FolderEntry, DriveStatus, etc.)
+├── upload-api.ts          # Client-side API helpers (check, uploadDrive, uploadGit)
+├── diff-files.ts          # File diff classification (new/changed/unchanged/deleted)
 ├── sanitize.ts            # Filename sanitization
 ├── auth.ts                # Upload secret validation (timing-safe)
 ├── github.ts              # Octokit helpers (getRemoteFolder, pushAllToGitHub)
-├── nextcloud.ts           # Nextcloud WebDAV client (native fetch)
+├── nextcloud.ts           # Nextcloud WebDAV client (native fetch, cached config)
 ├── blender.ts             # Blender Draco compression
 ├── commit-message.ts      # Commit message builder
 ├── parse-upload.ts        # FormData parser + validation
-├── validate-folder.ts     # Client-side folder validation
+├── validate-folder.ts     # Client-side folder validation (discriminated union)
 └── format-bytes.ts        # Byte formatting utility
 scripts/
 └── compress.py            # Blender Draco compression script