Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/admin/import/clothing/import-clothing-client.tsx

@@ -18,6 +18,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
 import { getAvatarUrl } from "@/lib/imager";
+import { adminFetch } from "@/lib/admin-fetch";
 
 // ── Shared types ─────────────────────────────────────────────────────────────
 
@@ -50,7 +51,7 @@ async function runSseImport(
 	onDone: (label: string) => void,
 	onComplete: (succeeded: number, failed: number) => void,
 ): Promise<void> {
-	const res = await fetch(url, {
+	const res = await adminFetch(url, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
@@ -155,7 +156,7 @@ function LibsView() {
 		try {
 			const params = new URLSearchParams({ page: String(pageNum) });
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/clothing?${params}`);
+			const res = await adminFetch(`/api/admin/import/clothing?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -251,7 +252,7 @@ function LibsView() {
 	async function remove(p: FigureItem) {
 		setBusyLib(p.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/clothing?lib=${encodeURIComponent(p.lib)}`,
 				{
 					method: "DELETE",
@@ -532,7 +533,7 @@ function SetsView() {
 		try {
 			const params = new URLSearchParams({ page: String(pageNum) });
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/clothing/sets?${params}`);
+			const res = await adminFetch(`/api/admin/import/clothing/sets?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");