Security hardening: env-based config, CSRF protection, secure code generation, plus presenter management and email communications system

- Move all credentials from hardcoded to .env with python-dotenv (add .env.example template and .gitignore)
- Add CSRF token generation and validation on all state-changing requests
- Replace random.choices with secrets.choice for all secure code generation
- Add session cookie security headers (HttpOnly, Secure, SameSite)
- Add presenter management: assign/remove presenters to breakout sessions, presenter QR scanning
- Add email communications system: templates per event, custom email sending, sent email tracking
- Add staff/organizer profile pages with staff code display
- New DB tables: event_email_templates, sent_emails, user_communications
- New DB columns: staff.reminder_count/reminder_dates, breakout_session_organizers.presenter_code
- Expand English translation strings across all new features

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/attendee/breakout_sessions.html

@@ -2,16 +2,6 @@
 
 {% block title %}{{ 'breakout_sessions'|t }} - {{ event.name }}{% endblock %}
 
-{% block extra_styles %}
-<style>
-.breakout-sessions {
-    max-width: 900px;
-    margin: 0 auto;
-    padding: 50px 40px;
-}
-</style>
-{% endblock %}
-
 {% block content %}
 <div class="breakout-sessions">
     <h1>{{ 'breakout_sessions'|t }} - {{ event.name }}</h1>
@@ -64,7 +54,7 @@
     {% endif %}
 
     <div class="back-link">
-        <a href="{{ url_for('attendee_dashboard') }}" class="btn btn-outline">{{ 'back_to_dashboard'|t }}</a>
+        <a href="{{ url_for('attendee_dashboard') }}" class="btn btn-outline"><i data-lucide="arrow-left"></i> {{ 'back_to_dashboard'|t }}</a>
     </div>
 </div>
 
@@ -84,12 +74,16 @@ document.querySelectorAll('.rsvp-btn').forEach(btn => {
             if (data.success) {
                 location.reload();
             } else {
-                alert(data.error || '{{ "error_occurred"|t }}');
+                showToast(data.error || '{{ "error_occurred"|t }}', 'error');
             }
         } catch (error) {
-            alert('{{ "error_processing_request"|t }}');
+            showToast('{{ "error_processing_request"|t }}', 'error');
         }
     });
 });
+
+document.addEventListener('DOMContentLoaded', function() {
+    lucide.createIcons();
+});
 </script>
 {% endblock %}