fix(security): close IDOR on computers/components update & destroy

- Scope update/destroy queries by userId (Computers & Components), matching
  the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
  current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
  'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
  of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
  committed); local file kept on disk

app/exceptions/invalid_component_selection_exception.ts

@@ -0,0 +1,17 @@
+import { Exception } from '@adonisjs/core/exceptions'
+import type { HttpContext } from '@adonisjs/core/http'
+
+/**
+ * Thrown when a component selection is invalid, either because:
+ * - the referenced component does not belong to the current user, or
+ * - more than one component of the same "unique" type is being attached
+ *   to the same computer at once.
+ */
+export default class InvalidComponentSelectionException extends Exception {
+  static status = 422
+  static code = 'E_INVALID_COMPONENT_SELECTION'
+
+  handle(error: this, { response }: HttpContext) {
+    return response.status(error.status).send({ errors: [{ message: error.message }] })
+  }
+}