Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/import/pets/import-pets-client.tsx

@@ -17,6 +17,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface PetItem {
 	lib: string;
@@ -57,7 +58,7 @@ export function ImportPetsClient() {
 		try {
 			const params = new URLSearchParams();
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/pets?${params}`);
+			const res = await adminFetch(`/api/admin/import/pets?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -99,7 +100,7 @@ export function ImportPetsClient() {
 
 	async function importViaSse(items: PetItem[]) {
 		setBatchProgress({ done: 0, total: items.length });
-		const res = await fetch("/api/admin/import/pets/batch", {
+		const res = await adminFetch("/api/admin/import/pets/batch", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ items, concurrency: 3 }),
@@ -161,7 +162,7 @@ export function ImportPetsClient() {
 	async function remove(p: PetItem) {
 		setBusyLib(p.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/pets?lib=${encodeURIComponent(p.lib)}`,
 				{
 					method: "DELETE",