Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/import/effects/import-effects-client.tsx

@@ -19,6 +19,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface EffectItem {
 	id: string;
@@ -50,7 +51,7 @@ export function ImportEffectsClient() {
 		try {
 			const params = new URLSearchParams();
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/effects?${params}`);
+			const res = await adminFetch(`/api/admin/import/effects?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -101,7 +102,7 @@ export function ImportEffectsClient() {
 
 	async function importViaSse(items: EffectItem[]) {
 		setBatchProgress({ done: 0, total: items.length });
-		const res = await fetch("/api/admin/import/effects/batch", {
+		const res = await adminFetch("/api/admin/import/effects/batch", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ items, concurrency: 3 }),
@@ -167,7 +168,7 @@ export function ImportEffectsClient() {
 	async function remove(e: EffectItem) {
 		setBusyLib(e.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/effects?lib=${encodeURIComponent(e.lib)}`,
 				{
 					method: "DELETE",