Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/app/shop/topup/TopUpForm.tsx

@@ -42,7 +42,11 @@ export default function TopUpForm({
         return;
       }
       // Hand off to PayPal for approval.
-      window.location.href = data.approveUrl;
+      const redirectUrl = new URL(data.approveUrl);
+      if (redirectUrl.protocol !== "https:") {
+        throw new Error("Invalid redirect URL: must be HTTPS");
+      }
+      window.location.href = redirectUrl.href;
     } catch {
       setError("Network error — please try again.");
       setPending(false);