security: faza 4 - ochrona CSRF panelu administracyjnego

- Nowa klasa \Shared\Security\CsrfToken (generate/validate/regenerate)
- Token CSRF we wszystkich formularzach edycji (form-edit.php)
- Walidacja CSRF w FormRequestHandler::handleSubmit()
- Token CSRF w formularzu logowania i formularzach 2FA
- Walidacja CSRF w App::special_actions() dla żądań POST
- Regeneracja tokenu po udanym logowaniu (bezpośrednia i przez 2FA)
- Fix XSS: htmlspecialchars na $alert w unlogged-layout.php
- 7 nowych testów CsrfTokenTest (817 testów łącznie)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -45,16 +45,20 @@ shopPRO is a PHP e-commerce platform with an admin panel and customer-facing sto
 # Specific test method
 ./test.ps1 --filter testGetQuantityReturnsCorrectValue
 
-# Alternative
-composer test
+# Alternatives
+composer test        # standard
+./test.bat           # testdox (readable list)
+./test-simple.bat    # dots
+./test-debug.bat     # debug output
+./test.sh            # Git Bash
 ```
 
 PHPUnit 9.6 via `phpunit.phar`. Bootstrap: `tests/bootstrap.php`. Config: `phpunit.xml`.
 
-Current suite: **810 tests, 2264 assertions**.
+Current suite: **817 tests, 2271 assertions**.
 
 ### Creating Updates
-See `docs/UPDATE_INSTRUCTIONS.md` for the full procedure. Updates are ZIP packages in `updates/0.XX/`. Never include `*.md` files, `updates/changelog.php`, or root `.htaccess` in update ZIPs.
+See `docs/UPDATE_INSTRUCTIONS.md` for the full procedure. Updates are ZIP packages in `updates/0.XX/`. Never include `*.md` files, `updates/changelog.php`, or root `.htaccess` in update ZIPs. ZIP structure must start directly from project directories — no version subfolder inside the archive.
 
 ## Architecture
 
@@ -229,6 +233,9 @@ Before starting implementation, review current state of docs.
 - `docs/DATABASE_STRUCTURE.md` — full database schema
 - `docs/TESTING.md` — test suite guide and structure
 - `docs/FORM_EDIT_SYSTEM.md` — form system architecture
+- `docs/CLASS_CATALOG.md` — full catalog of all classes with descriptions
+- `docs/TODO.md` — outstanding tasks and planned features
+- `docs/CRON_QUEUE_PLAN.md` — planned cron/queue architecture
 - `docs/CHANGELOG.md` — version history
 - `api-docs/api-reference.json` — REST API documentation (ordersPRO)
 - `api-docs/index.html` — REST API documentation (ordersPRO)