Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/lib/api-handler.ts

@@ -25,7 +25,10 @@ export function withAdmin(
 	handler: AdminHandler,
 ) {
 	return async (request: NextRequest, routeContext: RouteContext = {}) => {
-		if (options.requireCsrf === true && MUTATING_METHODS.has(request.method)) {
+		// CSRF required for mutating admin APIs unless explicitly opted out.
+		const csrfRequired =
+			options.requireCsrf !== false && MUTATING_METHODS.has(request.method);
+		if (csrfRequired) {
 			const csrfToken =
 				request.headers.get("x-csrf-token") ??
 				request.headers.get("csrf-token") ??