fix: resolve critical bugs and security issues across the project

Security:
- Disable SSL verification only in development (lib/req.js)
- Wrap all JSON.parse(cookie) calls in try-catch via safeJsonParse utility
- Sanitize dangerouslySetInnerHTML in blog/clinic with sanitizeHtml utility
- Fix open redirect in payment page — validate URL origin before redirect
- Fix cookie cleanup on 401 — use js-cookie with correct domain scope

Performance:
- Wrap ItemDoctor with React.memo to prevent unnecessary re-renders
- Replace <img> with Next.js <Image> in blog Caption component

Functionality:
- Fix memory leak in Recode.js — store intervals in refs, cleanup on unmount
- Add null guard on retryIcon.current before classList manipulation
- Fix getParsedUserInfo in helper to handle malformed cookie gracefully

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/ability.js

@@ -1,4 +1,5 @@
 import { AbilityBuilder, createMongoAbility } from "@casl/ability";
+import { safeJsonParse } from "./sanitize";
 
 export function defineAbilitiesFor(user) {
   const { can, cannot, build } = new AbilityBuilder(createMongoAbility);
@@ -6,9 +7,9 @@ export function defineAbilitiesFor(user) {
   if (user) {
     can("access", "Dashboard");
     cannot("access", "Login");
-    const parsedData = JSON.parse(user.value);
-
-    if (parsedData.roles && Object.values(parsedData.roles).includes("representation")) {
+    const parsedData = safeJsonParse(user.value);
+    const roles = parsedData?.roles;
+    if (roles && Array.isArray(Object.values(roles)) && Object.values(roles).includes("representation")) {
       can("access", "Panel");
     }
   } else {