Implement CSRF protection for user invitation and management actions; add QR code generation script; secure internal includes directory with .htaccess

auth/invite.php

@@ -191,7 +191,7 @@ $pageTitle = "Fociz — Uitnodiging Accepteren";
             </p>
 
             <div class="inline-block p-3 bg-white rounded-2xl shadow-xs border border-slate-200 dark:border-slate-800">
-                <img src="<?= htmlspecialchars($qrCodeUrl) ?>" alt="2FA QR Code" class="w-40 h-40 mx-auto">
+                <div id="qrcode" class="w-40 h-40 mx-auto flex items-center justify-center"></div>
             </div>
 
             <div class="bg-slate-50 dark:bg-[#0c0f17] border border-slate-200 dark:border-slate-800 rounded-xl p-2.5 text-xs text-slate-600 dark:text-slate-400 max-w-sm mx-auto font-mono">
@@ -213,8 +213,20 @@ $pageTitle = "Fociz — Uitnodiging Accepteren";
     </form>
 </div>
 
+<script src="/assets/js/qrcode.min.js"></script>
 <script>
     if (typeof lucide !== 'undefined') lucide.createIcons();
+    const qrContainer = document.getElementById('qrcode');
+    if (qrContainer) {
+        new QRCode(qrContainer, {
+            text: <?= json_encode($otpAuthUrl) ?>,
+            width: 160,
+            height: 160,
+            colorDark: '#000000',
+            colorLight: '#ffffff',
+            correctLevel: QRCode.CorrectLevel.M
+        });
+    }
 </script>
 </body>
 </html>