refactor: csrf protection implementation

[deepsource-dev-autofix]

This PR refactors the application to add robust CSRF protection across form rendering and submission endpoints. It introduces secure token generation, embeds the token in form payloads, and enforces validation on every POST request. Additionally, minor updates have been made to translation function calls for consistency.

• CSRF: DeepSource flagged missing CSRF defenses, leaving the application vulnerable to cross-site request forgery. We now generate a 32-byte random token using PHP’s random_bytes(), store it in the session (ensuring session_start() has been called), and include it as a hidden field in all forms. On each POST request, the submitted token is compared against the session value using hash_equals() (or strict comparison where appropriate), returning a 403 Forbidden response if validation fails. This change prevents unauthorized third-party requests from performing state-changing actions.

This Autofix was generated by AI. Please review the change before merging.