feat(admin): SmartAdmin template redesign + security hardening

- Migrated all admin views from inline JS string templates to EJS
- Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid
- Added express-ejs-layouts for master layout wrapper
- Security:
  - CSRF protection (double-submit cookie)
  - Rate limiting on /login (5/15min)
  - Token revocation via jti + globalLogoutTimestamp
  - Re-auth (reauth_token) for destructive endpoints
  - Settings whitelist (ALLOWED_KEYS) + removed process.exit
  - Seed phrases no longer rendered in HTML (CSV export only)
  - Multer fileFilter for image uploads + safe filename generation
  - SQL injection fix (currency column allowlist)
  - Global error handler + asyncHandler wrapper
- New files: csrf.js, errorHandler.js, error.ejs, all EJS templates
- SmartAdmin assets: CSS, icons, webfonts, plugins, scripts

src/admin/routes/locations.js

@@ -1,6 +1,5 @@
 import { Router } from 'express';
 import db from '../../config/database.js';
-import { renderLocationList } from '../views/locations.js';
 
 const router = Router();
 
@@ -9,7 +8,7 @@ router.get('/', async (req, res) => {
     (SELECT COUNT(*) FROM categories WHERE location_id = l.id) as category_count,
     (SELECT COUNT(*) FROM products WHERE location_id = l.id) as product_count
     FROM locations l ORDER BY l.country, l.city, l.district`);
-  res.send(renderLocationList(locations));
+  res.render('locations', { title: 'Locations', locations });
 });
 
 router.post('/', async (req, res) => {