Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/sounds/sounds-client.tsx

@@ -46,6 +46,7 @@ import { useServerAction } from "@/hooks/use-server-action";
 import { invalidateSongPickerCache } from "@/lib/client-cache/song-picker-cache";
 import { parseTraxChannels } from "@/lib/trax-format";
 import { TraxPlayer } from "./trax-player";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface SoundtrackRow {
 	id: number;
@@ -434,7 +435,7 @@ function UploadDialog({
 		fd.append("author", author.trim());
 
 		try {
-			const res = await fetch("/api/admin/sounds/upload", {
+			const res = await adminFetch("/api/admin/sounds/upload", {
 				method: "POST",
 				body: fd,
 			});