fix: address security vulnerabilities and add image attachments

- Fix type confusion vulnerability in comment content updates
- Validate pagination offsets to prevent negative values
- Validate timestamp is a valid number before parsing
- Exclude guestEmail from comment API responses for privacy
- Fix TypeScript error in audio upload route
- Add image attachment support for comments with upload API
- Update admin dashboard to track image attachments
- Rename cleanup functions to handle both voice and image media

app/api/workspaces/[workspaceId]/route.ts

@@ -2,7 +2,7 @@ import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
-import { cleanupWorkspaceVoiceFiles } from '@/lib/r2-cleanup';
+import { cleanupWorkspaceMediaFiles } from '@/lib/r2-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ workspaceId: string }> };
@@ -145,7 +145,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
         }
 
         // Clean up voice files from R2 before cascade delete removes comment rows
-        await cleanupWorkspaceVoiceFiles(workspaceId);
+        await cleanupWorkspaceMediaFiles(workspaceId);
 
         await db.workspace.delete({ where: { id: workspaceId } });