refactor(lib): fix critical security, memory leaks, and architectural

duplications

This major overhaul of the `lib/` directory addresses critical
vulnerabilities,
performance bottlenecks, and massive code duplications across the core
framework.

- **app.js**: Secured unprotected admin routes (RCE risk), fixed memory
  leak in
  auto-updater intervals, and fixed DevServer middleware injection bug.
- **routing/route-manager.js**: Removed 6 duplicated methods, fixed
  custom rate-limit
  memory leak (OOM risk), and optimized regex execution to prevent Event
  Loop blocking.
- **layout/layout-manager.js**: Replaced blocking `readFileSync` with
  async I/O,
  added lock mechanism to prevent race conditions during layout
  creation, and
  removed redundant EJS double-escaping.
- **dev/dev-server.js**: Removed global process hijacking
  (`uncaughtException`),
  fixed incorrect WebSocket port in injected client, secured HTML
  injection against
  JSON corruption, and added auto-reconnect to client script.
- **core/auto-updater.js**: Converted to instance class, fixed
  destructive rollback
  bug (safe temp-dir swap), fixed version comparison crash, added
  missing SHA-512
  integrity verification, and made all I/O operations non-blocking.
- **core/auth-manager.js**: Implemented missing `setupViews` method
  (crash fix),
  fixed broken route middleware chaining, removed memory-leaking custom
  rate limiters,
  and secured CSRF validation against `RangeError` crashes.
- **plugin-manager.js**: Merged 5 duplicate methods, fixed `setInterval`
  and `chokidar`
  memory leaks, and implemented missing sandbox/validation methods.
- **adapters/nextjs-adapter.js**: Fixed infinite hang in serverless API
  handlers,
  fixed `res.end` context crash, and replaced dangerous monkey-patching
  with safe wrappers.
- **core/module-installer.js**: Removed `process.exit(1)` library
  anti-pattern,
  updated vulnerable dependency versions, and switched to async
  execution.
- **core/logger.js**: Added object inspection for complex logs,
  integrated file logging,
  and added environment awareness to suppress dev logs in production.

Author: l0wkn1ght

coverage/clover.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<coverage generated="1783303650959" clover="3.2.0">
-  <project timestamp="1783303650959" name="All files">
+<coverage generated="1783357108809" clover="3.2.0">
+  <project timestamp="1783357108811" name="All files">
     <metrics statements="0" coveredstatements="0" conditionals="0" coveredconditionals="0" methods="0" coveredmethods="0" elements="0" coveredelements="0" complexity="0" loc="0" ncloc="0" packages="0" files="0" classes="0"/>
   </project>
 </coverage>

coverage/lcov-report/index.html

@@ -86,7 +86,7 @@ <h1>All files</h1>
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2026-07-06T02:07:30.820Z
+                at 2026-07-06T16:58:28.737Z
             </div>
         <script src="prettify.js"></script>
         <script>

package-lock.json

@@ -1,2 +1,2 @@
-body { font-family: Arial, sans-serif; margin: 40px; } 
-h1 { color: #3498db; } 
+body { font-family: Arial, sans-serif; margin: 40px; }
+h1 { color: #3498db; }

templates/public/css/style.css

@@ -1 +1 @@
-console.log('Vako loaded'); 
+console.log('Vako loaded')