Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/lib/validators/catalog.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+export const translateItemsSchema = z.object({
+	items: z
+		.array(
+			z.object({
+				id: z.coerce.number().int().positive(),
+				publicName: z.string().min(1, "Name is required").max(255),
+				description: z.string().max(1000).optional().default(""),
+			}),
+		)
+		.min(1, "At least one item required")
+		.max(500),
+});
+
+export type TranslateItemsInput = z.infer<typeof translateItemsSchema>;