fix(web): frontend quality — XSS, error states, a11y, image optimization, security headers

- Whitelist OAuth error codes; never render raw URL params (XSS fix)
- Add error state UI with retry button for API failures on homepage and search
- Use <article> for property cards with ARIA labels and semantic list markup
- Replace raw <img> with Next.js <Image> across all listing/gallery/KYC pages
- Add security headers (X-Content-Type-Options, X-Frame-Options, etc.) in next.config.js
- Gate console.error behind NODE_ENV check in global error boundary
- Mapbox confirmed npm-bundled (SRI N/A)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/app/(public)/page.tsx

@@ -37,15 +37,22 @@ export default function LandingPage() {
   const [propertyType, setPropertyType] = React.useState('');
   const [featuredListings, setFeaturedListings] = React.useState<ListingDetail[]>([]);
   const [loadingFeatured, setLoadingFeatured] = React.useState(true);
+  const [featuredError, setFeaturedError] = React.useState(false);
 
-  React.useEffect(() => {
+  const fetchFeatured = React.useCallback(() => {
+    setLoadingFeatured(true);
+    setFeaturedError(false);
     listingsApi
       .search({ status: 'ACTIVE', limit: 6 })
       .then((res) => setFeaturedListings(res.data))
-      .catch(() => {})
+      .catch(() => setFeaturedError(true))
       .finally(() => setLoadingFeatured(false));
   }, []);
 
+  React.useEffect(() => {
+    fetchFeatured();
+  }, [fetchFeatured]);
+
   const handleSearch = (e: React.FormEvent) => {
     e.preventDefault();
     const params = new URLSearchParams();
@@ -147,6 +154,13 @@ export default function LandingPage() {
             <div className="mt-8 flex min-h-[300px] items-center justify-center">
               <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
             </div>
+          ) : featuredError ? (
+            <div className="mt-8 flex min-h-[200px] flex-col items-center justify-center gap-3 text-muted-foreground">
+              <p>Không thể tải tin đăng. Vui lòng thử lại.</p>
+              <Button variant="outline" size="sm" onClick={fetchFeatured}>
+                Thử lại
+              </Button>
+            </div>
           ) : featuredListings.length > 0 ? (
             <div className="mt-8 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
               {featuredListings.map((listing) => (