Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/import/furni/nitro-editor-dialog.tsx

@@ -31,6 +31,7 @@ import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Textarea } from "@/components/ui/textarea";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface NitroEditorDialogProps {
 	classname: string;
@@ -121,7 +122,7 @@ export function NitroEditorDialog({
 		setLoading(true);
 		setJsonError(null);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/furni/nitro-editor?classname=${encodeURIComponent(classname)}`,
 			);
 			if (!res.ok) {
@@ -189,7 +190,7 @@ export function NitroEditorDialog({
 
 		setSaving(true);
 		try {
-			const res = await fetch("/api/admin/import/furni/nitro-editor", {
+			const res = await adminFetch("/api/admin/import/furni/nitro-editor", {
 				method: "PUT",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({