Add security comments to path handling in various scripts to clarify internal constant usage and mitigate path traversal risks. Update logging in registration and verification processes for improved clarity.

server/api/media/internal/[...path].get.js

@@ -35,6 +35,8 @@ export default defineEventHandler(async (event) => {
   const filePath = resolveInternalPath(reqPath)
   // check existence and ensure it stays within baseDir
   const baseDir = path.join(process.cwd(), 'server', 'private', 'gallery-internal')
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+  // filePath is validated against baseDir via startsWith(path.resolve(baseDir)) below.
   const resolved = path.resolve(filePath)
   if (!resolved.startsWith(path.resolve(baseDir))) {
     throw createError({ statusCode: 400, statusMessage: 'Ungültiger Pfad' })