Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/layout.tsx

@@ -11,6 +11,7 @@ import { LanguageSwitcher } from "@/components/language-switcher";
 import { ThemeSwitcher } from "@/components/theme-switcher";
 import { requireStaff } from "@/lib/admin/guard";
 import { ADMIN_NAV_GROUPS } from "@/lib/admin-nav";
+import { setCsrfCookie } from "@/lib/foundation/security";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -22,6 +23,7 @@ export default async function AdminLayout({
 	children: ReactNode;
 }) {
 	const staff = await requireStaff();
+	const csrfToken = await setCsrfCookie();
 	if (await siteSettings.getBool("force_staff_2fa", false)) {
 		const u = await prisma.user
 			.findUnique({
@@ -33,18 +35,21 @@ export default async function AdminLayout({
 	}
 
 	return (
-		<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
-			<div
-				data-admin
-				className="flex flex-col min-w-0 p-5 lg:p-6 min-h-screen"
-				style={{ backgroundColor: "var(--admin-canvas)" }}
-			>
-				<AdminTopbar staff={staff} />
-				<section className="admin-page flex-1">
-					<AdminHubChrome>{children}</AdminHubChrome>
-				</section>
-			</div>
-		</AdminMobileWrapper>
+		<>
+			<meta name="csrf-token" content={csrfToken} />
+			<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
+				<div
+					data-admin
+					className="flex flex-col min-w-0 p-5 lg:p-6 min-h-screen"
+					style={{ backgroundColor: "var(--admin-canvas)" }}
+				>
+					<AdminTopbar staff={staff} />
+					<section className="admin-page flex-1">
+						<AdminHubChrome>{children}</AdminHubChrome>
+					</section>
+				</div>
+			</AdminMobileWrapper>
+		</>
 	);
 }