Security hardening: env-based config, CSRF protection, secure code generation, plus presenter management and email communications system

- Move all credentials from hardcoded to .env with python-dotenv (add .env.example template and .gitignore)
- Add CSRF token generation and validation on all state-changing requests
- Replace random.choices with secrets.choice for all secure code generation
- Add session cookie security headers (HttpOnly, Secure, SameSite)
- Add presenter management: assign/remove presenters to breakout sessions, presenter QR scanning
- Add email communications system: templates per event, custom email sending, sent email tracking
- Add staff/organizer profile pages with staff code display
- New DB tables: event_email_templates, sent_emails, user_communications
- New DB columns: staff.reminder_count/reminder_dates, breakout_session_organizers.presenter_code
- Expand English translation strings across all new features

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/staff/communications.html

@@ -0,0 +1,36 @@
+{% extends "base.html" %}
+
+{% block title %}{{ 'communications'|t }} - NetEvents{% endblock %}
+
+{% block content %}
+<div class="communications-page">
+    <div class="page-header">
+        <h1>{{ 'my_messages'|t }}</h1>
+    </div>
+
+    {% if emails %}
+        <div class="communications-list">
+            {% for email in emails %}
+                <div class="communication-card">
+                    <div class="communication-header">
+                        <span class="communication-event">{{ email.event_name }}</span>
+                        <span class="communication-date">{{ email.sent_at|localized_date }}</span>
+                    </div>
+                    <h3>{{ email.subject }}</h3>
+                    <p class="communication-body">{{ email.body }}</p>
+                </div>
+            {% endfor %}
+        </div>
+    {% else %}
+        <div class="section-box">
+            <p class="text-muted text-center">{{ 'no_messages_yet'|t }}</p>
+        </div>
+    {% endif %}
+</div>
+
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+    lucide.createIcons();
+});
+</script>
+{% endblock %}