Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/lib/auth/laravel-encrypter.ts

@@ -30,6 +30,8 @@ export class LaravelEncrypter {
   encrypt(value: string, serialize = true): string {
     const iv = randomBytes(16);
     const data = serialize ? phpSerializeString(value) : value;
+    // CBC mode is required for Laravel compatibility. Integrity is provided by
+    // the HMAC-SHA256 mac (verified by decrypt before any output is returned).
     const cipher = createCipheriv("aes-256-cbc", this.key, iv);
     const valueB64 = cipher.update(data, "utf8", "base64") + cipher.final("base64");
     const ivB64 = iv.toString("base64");
@@ -51,6 +53,7 @@ export class LaravelEncrypter {
       throw new Error("The MAC is invalid.");
     }
     const iv = Buffer.from(json.iv, "base64");
+    // CBC mode required for Laravel compatibility; MAC already verified above.
     const decipher = createDecipheriv("aes-256-cbc", this.key, iv);
     const plain = decipher.update(json.value, "base64", "utf8") + decipher.final("utf8");
     return serialize ? phpUnserializeString(plain) : plain;