Add CSRF, CAPTCHA, and input validation improvements

Introduces CSRF protection to all sensitive controller actions, integrates configurable CAPTCHA (reCAPTCHA v2/v3, Turnstile) for authentication and registration flows, and centralizes input validation via a new InputValidator helper. Adds new helpers and services for CSRF and CAPTCHA, updates settings and migration for CAPTCHA configuration, and enhances logging and error handling in TLD registry import processes. Also improves validation for user, domain, group, and profile inputs throughout the application.

app/Views/tld-registry/import-progress.php

@@ -21,7 +21,7 @@ ob_start();
                         'check_updates' => 'Checking for IANA updates',
                         'complete_workflow' => 'Complete TLD import workflow (TLD List → RDAP → WHOIS & Registry Data)'
                     ];
-                    echo $descriptions[$import_type] ?? 'Processing import';
+                    echo htmlspecialchars($descriptions[$import_type] ?? 'Processing import');
                     ?>
                 </p>
             </div>
@@ -194,7 +194,10 @@ function updateProgress(data) {
         statusBadge.className = 'inline-flex items-center px-3 py-1 rounded-full text-sm font-medium bg-green-100 text-green-800';
         statusText.innerHTML = '<i class="fas fa-check mr-2"></i>Complete';
         isComplete = true;
-        addLogMessage('Import completed successfully!', 'success');
+        
+        // Show the actual completion message from API
+        const completionMessage = data.message || 'Import completed successfully!';
+        addLogMessage(completionMessage, 'success');
         
         // Mark all steps as completed for complete workflow
         if (importType === 'complete_workflow') {

app/Views/tld-registry/index.php

@@ -33,6 +33,7 @@ $currentFilters = $filters ?? ['search' => '', 'sort' => 'tld', 'order' => 'asc'
         <?php if (isset($_SESSION['role']) && $_SESSION['role'] === 'admin'): ?>
         <div class="flex flex-wrap gap-2">
             <form method="POST" action="/tld-registry/start-progressive-import" class="inline">
+                <?= csrf_field() ?>
                 <input type="hidden" name="import_type" value="complete_workflow">
                 <button type="submit" class="inline-flex items-center px-4 py-2.5 bg-blue-600 text-white text-sm rounded-lg hover:bg-blue-700 transition-colors font-medium" title="Complete TLD import workflow: TLD List → RDAP → WHOIS → Registry URLs">
                     <i class="fas fa-rocket mr-2"></i>
@@ -40,6 +41,7 @@ $currentFilters = $filters ?? ['search' => '', 'sort' => 'tld', 'order' => 'asc'
                 </button>
             </form>
             <form method="POST" action="/tld-registry/start-progressive-import" class="inline">
+                <?= csrf_field() ?>
                 <input type="hidden" name="import_type" value="check_updates">
                 <button type="submit" <?= $stats['total'] == 0 ? 'disabled' : '' ?> class="inline-flex items-center px-4 py-2.5 <?= $stats['total'] == 0 ? 'bg-gray-400 cursor-not-allowed' : 'bg-purple-600 hover:bg-purple-700' ?> text-white text-sm rounded-lg transition-colors font-medium" title="<?= $stats['total'] == 0 ? 'Import TLDs first' : 'Check for IANA updates' ?>">
                     <i class="fas fa-sync-alt mr-2"></i>
@@ -205,6 +207,7 @@ $currentFilters = $filters ?? ['search' => '', 'sort' => 'tld', 'order' => 'asc'
         <div class="flex items-center space-x-4">
             <span class="text-sm text-gray-600">Bulk Actions:</span>
             <form method="POST" action="/tld-registry/bulk-delete" id="bulk-delete-form" class="inline">
+                <?= csrf_field() ?>
                 <button type="button" onclick="confirmBulkDelete()" class="inline-flex items-center px-3 py-2 border border-red-300 text-red-700 text-sm rounded-lg hover:bg-red-50 transition-colors font-medium">
                     <i class="fas fa-trash mr-2"></i>
                     Delete Selected