Improve security, validation, and isolation checks

Add multiple security and validation improvements across the app:

- Prevent session fixation: regenerate session ID on login and after successful 2FA; tighten session cookie params (Secure, HttpOnly, SameSite=Lax).
- Harden installer: add CSRF checks for install/update flows and use PDO::quote when injecting admin credentials into SQL migration to avoid injection; add csrf_field() to installer templates.
- Template hardening: add safe_url and safe_mailto Twig filters, escape tag names for JS, and add rel="noopener noreferrer" to external links to mitigate XSS/opener risks.
- Domain controller: validate referrer to avoid open redirects, enforce user isolation mode when finding/deleting/updating domains and when assigning notification groups (ensures users only affect their own resources).
- Notification groups: verify channel belongs to group before deleting or toggling to prevent unauthorized access.
- ErrorLog: whitelist allowed sort columns to avoid arbitrary column injection in ORDER BY.
- Routes: move the debug whois route to protected/admin area.

These changes collectively reduce attack surface (XSS, open redirect, session fixation, SQL injection) and enforce proper resource isolation and input validation.

app/Controllers/TwoFactorController.php

@@ -275,6 +275,9 @@ class TwoFactorController extends Controller
         $this->twoFactorService->recordAttempt($userId, $ipAddress, $verified);
 
         if ($verified) {
+            // Regenerate session ID to prevent session fixation
+            session_regenerate_id(true);
+
             // Clear 2FA requirement and complete login
             $pendingRemember = !empty($_SESSION['pending_remember']);
             unset($_SESSION['2fa_required']);
@@ -343,6 +346,8 @@ class TwoFactorController extends Controller
             return;
         }
 
+        $this->verifyCsrf('/2fa/verify');
+
         try {
             // Check if user is in 2FA verification state
             if (!isset($_SESSION['2fa_required']) || !$_SESSION['2fa_required']) {