fix: patch SSRF in Gemini proxy and payload injection in brochure APIs

sites/build.mjs

@@ -1117,7 +1117,8 @@ export default {
     if (p === "/api/book" && request.method === "POST") {
       try {
         const data = await request.json();
-        await fireAlert(env, { kind: "booking", site: SITE_ID, ...data });
+        const { name, phone, vehicle, notes, timestamp } = data;
+        await fireAlert(env, { kind: "booking", site: SITE_ID, name, phone, vehicle, notes, timestamp });
         return new Response(JSON.stringify({ ok: true }), { headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" } });
       } catch (e) {
         return new Response(JSON.stringify({ ok: false, error: e.message }), { status: 400, headers: { "Content-Type": "application/json" } });
@@ -1126,7 +1127,8 @@ export default {
     if (p === "/api/intake" && request.method === "POST") {
       try {
         const data = await request.json();
-        await fireAlert(env, { kind: "intake", site: SITE_ID, ...data });
+        const { client_name, client_phone, client_email, matter_type, summary, urgency, area, timestamp } = data;
+        await fireAlert(env, { kind: "intake", site: SITE_ID, client_name, client_phone, client_email, matter_type, summary, urgency, area, timestamp });
         return new Response(JSON.stringify({ ok: true }), { headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" } });
       } catch (e) {
         return new Response(JSON.stringify({ ok: false, error: e.message }), { status: 400, headers: { "Content-Type": "application/json" } });
@@ -1135,7 +1137,8 @@ export default {
     if (p === "/api/chat" && request.method === "POST") {
       try {
         const data = await request.json();
-        await fireAlert(env, { kind: "chat", site: SITE_ID, ...data });
+        const { message, sessionId, timestamp } = data;
+        await fireAlert(env, { kind: "chat", site: SITE_ID, message, sessionId, timestamp });
         const msg = (data.message || "").toLowerCase();
         let reply;
         if (VERTICAL === "law") {