Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/lib/auth/password.ts

@@ -21,7 +21,13 @@ function hashDriver(): "bcrypt" | "argon2id" {
   return process.env.PASSWORD_HASH?.toLowerCase() === "argon2id" ? "argon2id" : "bcrypt";
 }
 
-/** Lowercase hex md5 of a UTF-8 string (matches PHP md5()). */
+/**
+ * Lowercase hex md5 of a UTF-8 string (matches PHP md5()).
+ *
+ * This is deliberately MD5 to match PHP's md5() output so we can verify legacy
+ * AtomCMS password hashes during the on-login upgrade path (isMd5Of → checkLogin).
+ * It is NOT used to hash new passwords and does NOT affect credential security.
+ */
 export function md5Hex(input: string): string {
   return createHash("md5").update(input, "utf8").digest("hex");
 }