Implement CSRF protection for user invitation and management actions; add QR code generation script; secure internal includes directory with .htaccess

includes/settings.php

@@ -110,7 +110,14 @@ function get_workday_settings(): array {
  */
 function get_ai_settings(): array {
     $envKey = fociz_env('OPENAI_API_KEY', '');
-    $savedKey = get_system_setting('ai_api_key', '');
+    $savedKeyRaw = get_system_setting('ai_api_key', '');
+    $savedKey = '';
+    if (!empty($savedKeyRaw)) {
+        if (!function_exists('fociz_decrypt')) {
+            require_once __DIR__ . '/auth.php';
+        }
+        $savedKey = fociz_decrypt($savedKeyRaw);
+    }
     $apiKey = !empty($savedKey) ? $savedKey : $envKey;
 
     return [