fix(ux-security): address UI, auth feedback and SVG config issues (#263, #265, #266, #267)

next.config.ts

@@ -59,6 +59,8 @@ const nextConfig: NextConfig = {
   devIndicators: false,
   images: {
     dangerouslyAllowSVG: true,
+    contentSecurityPolicy: "default-src 'self'; script-src 'none'; sandbox;",
+    contentDispositionType: "attachment",
     remotePatterns: [
       { protocol: "https", hostname: "avatars.githubusercontent.com" },
       { protocol: "https", hostname: "api.dicebear.com" },

src/app/auth/callback/CallbackClient.tsx

@@ -28,7 +28,9 @@ export function CallbackClient() {
         <>
           <p className="font-medium text-rose-600">{error}</p>
           <p className="mt-2 text-sm text-slate-500 dark:text-slate-400">
-            Make sure the mergefi-backend is running and reachable.
+            {searchParams.get("token")
+              ? "Make sure the mergefi-backend is running and reachable."
+              : "Please return to /connect and try signing in again."}
           </p>
         </>
       ) : (

src/app/auth/callback/page.tsx

@@ -3,7 +3,13 @@ import { CallbackClient } from "./CallbackClient";
 
 export default function AuthCallbackPage() {
   return (
-    <Suspense>
+    <Suspense
+      fallback={
+        <div className="mx-auto max-w-md px-6 py-24 text-center text-slate-500 dark:text-slate-400">
+          Finishing sign-in…
+        </div>
+      }
+    >
       <CallbackClient />
     </Suspense>
   );

src/app/issues/[id]/IssueActions.tsx

@@ -102,7 +102,9 @@ export function IssueActions({ bounty }: { bounty: Bounty }) {
               ? "Payout complete"
               : bounty.status === "in_review"
                 ? "Awaiting PR merge"
-                : "No action available"}
+                : bounty.status === "merged"
+                  ? "Payout pending"
+                  : "No action available"}
           </Button>
         )}
       </div>