refactor: full codebase audit — extract modules, fix type safety, clean dead code

- Extract API helpers from UploadZone into lib/upload-api.ts (FormData builder, checkFolderDiffs, uploadDrive, uploadGit)
- Extract upload orchestration into hooks/useUploadOrchestrator.ts (UploadZone: 489 → 162 lines)
- Extract file diff classification into lib/diff-files.ts (from git route)
- Extract shared SVG icons into components/ui/icons.tsx (7 icons, 0 duplication)
- Extract shared modal wrapper into components/ui/Modal.tsx + ModalActions
- Extract DriveStatusLine sub-component from FolderCard
- Fix checkFolderDiffs silently swallowing auth/network errors (now throws)
- Fix type safety: remove as never casts, add isHttpError type guard, use discriminated union for validateFolder
- Fix nextcloud: cache getConfig, add max bound to findNextVersion, optimize mkdirRecursive (skip PROPFIND)
- Fix drive route: remove req.clone(), extend parseMultiUpload to return extra fields
- Fix commit message: model shown as unchanged with ↔️ on updates (not falsely marked as modified)
- Clean dead code: unused folderExists import, FileStatus/DriveStatus exports, ParsedFile.textureName, getConfig basePath
- Add security headers in next.config.ts (HSTS, X-Content-Type-Options, X-Frame-Options, etc.)
- Update README with new project structure

lib/parse-upload.ts

@@ -4,21 +4,27 @@ import { sanitizeFilename } from './sanitize'
 import { ALL_ALLOWED_EXTENSIONS, MODEL_EXTENSIONS, VALID_DESTINATIONS, MAX_FILE_SIZE } from './constants'
 import type { ParsedFile } from './types'
 
-/**
- * Parse a multi-file FormData upload request.
- * Validates destination, file extensions, file sizes, and returns parsed files.
- */
-export async function parseMultiUpload(req: NextRequest): Promise<{
+export interface ParsedUpload {
   folderName: string
   destination: string
   files: ParsedFile[]
-}> {
+  /** Any extra string fields from the FormData (e.g. "action") */
+  extra: Record<string, string>
+}
+
+/**
+ * Parse a multi-file FormData upload request.
+ * Validates destination, file extensions, file sizes, and returns parsed files.
+ * Extra string fields (beyond folderName, destination, files, fileTypes, textureNames)
+ * are returned in `extra`.
+ */
+export async function parseMultiUpload(req: NextRequest): Promise<ParsedUpload> {
   const formData = await req.formData()
   const folderName = (formData.get('folderName') as string | null)?.trim() || 'assets'
   const safeFolderName = sanitizeFilename(folderName).replace(/[^a-zA-Z0-9-_]/g, '-')
 
   const rawDestination = (formData.get('destination') as string | null)?.trim() || 'general'
-  if (!VALID_DESTINATIONS.has(rawDestination as never)) {
+  if (!VALID_DESTINATIONS.has(rawDestination)) {
     throw new Error(`Destination invalide: "${rawDestination}"`)
   }
   const destination = rawDestination
@@ -27,6 +33,15 @@ export async function parseMultiUpload(req: NextRequest): Promise<{
   const fileTypes = formData.getAll('fileTypes') as string[]
   const textureNames = formData.getAll('textureNames') as string[]
 
+  // Collect extra string fields
+  const knownKeys = new Set(['folderName', 'destination', 'files', 'fileTypes', 'textureNames'])
+  const extra: Record<string, string> = {}
+  for (const [key, value] of formData.entries()) {
+    if (!knownKeys.has(key) && typeof value === 'string') {
+      extra[key] = value
+    }
+  }
+
   // Runtime validation: ensure entries are actual File objects
   const fileEntries: File[] = []
   for (const entry of rawFiles) {
@@ -73,8 +88,8 @@ export async function parseMultiUpload(req: NextRequest): Promise<{
     const isModel = MODEL_EXTENSIONS.has(ext)
     const buffer = Buffer.from(await file.arrayBuffer())
 
-    parsed.push({ filename, buffer, isModel, textureName: texName || undefined })
+    parsed.push({ filename, buffer, isModel })
   }
 
-  return { folderName: safeFolderName, destination, files: parsed }
+  return { folderName: safeFolderName, destination, files: parsed, extra }
 }