Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/lib/auth/laravel-encrypter.test.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { describe, expect, it } from "vitest";
 import {
   LaravelEncrypter,
@@ -6,7 +7,9 @@ import {
 } from "./laravel-encrypter";
 
 // A deterministic 32-byte key in Laravel's "base64:" form.
-const APP_KEY = `base64:${Buffer.from("0123456789abcdef0123456789abcdef").toString("base64")}`;
+const APP_KEY = `base64:${Buffer.from(
+  "0123456789abcdef0123456789abcdef",
+).toString("base64")}`;
 
 describe("LaravelEncrypter", () => {
   it("rejects a key that is not 32 bytes", () => {
@@ -15,10 +18,10 @@ describe("LaravelEncrypter", () => {
 
   it("round-trips encrypt/decrypt (serialize=true, like Laravel encrypt())", () => {
     const enc = new LaravelEncrypter(APP_KEY);
-    const secret = "JBSWY3DPEHPK3PXP"; // a TOTP secret
-    const payload = enc.encrypt(secret);
-    expect(payload).not.toContain(secret);
-    expect(enc.decrypt(payload)).toBe(secret);
+    const plaintext = randomBytes(16).toString("hex");
+    const payload = enc.encrypt(plaintext);
+    expect(payload).not.toContain(plaintext);
+    expect(enc.decrypt(payload)).toBe(plaintext);
   });
 
   it("round-trips encryptString/decryptString (serialize=false)", () => {