Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/app/api/paypal/create/route.ts

@@ -11,6 +11,7 @@ import {
 	PAYPAL_CURRENCY,
 } from "@/lib/services/paypal";
 import { recordCreatedTopup } from "@/lib/services/paypal-topup";
+import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
 
@@ -68,10 +69,12 @@ export async function POST(req: Request): Promise<Response> {
 
 	const credits = Math.floor(amount * creditsPerUnit());
 	const base = env.APP_URL.replace(/\/+$/, "");
+	const hotelName =
+		(await siteSettings.get("hotel_name", env.HOTEL_NAME)) ?? env.HOTEL_NAME;
 
 	try {
 		const order = await createOrder(amount, {
-			description: `${env.HOTEL_NAME} top-up: ${credits} credits`,
+			description: `${hotelName} top-up: ${credits} credits`,
 			returnUrl: `${base}/shop/topup?status=success`,
 			cancelUrl: `${base}/shop/topup?status=cancel`,
 		});