Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/lib/auth/totp.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
-import { generateTotp, totpKeyUri, verifyTotp } from "./totp";
+import { generateTotp, generateTotpSecret, totpKeyUri, verifyTotp } from "./totp";
 
-const SECRET = "JBSWY3DPEHPK3PXP"; // standard base32 test secret
+const SECRET = generateTotpSecret();
 
 describe("totp", () => {
   it("verifies the current generated code", () => {