Security hardening: env-based config, CSRF protection, secure code generation, plus presenter management and email communications system

- Move all credentials from hardcoded to .env with python-dotenv (add .env.example template and .gitignore)
- Add CSRF token generation and validation on all state-changing requests
- Replace random.choices with secrets.choice for all secure code generation
- Add session cookie security headers (HttpOnly, Secure, SameSite)
- Add presenter management: assign/remove presenters to breakout sessions, presenter QR scanning
- Add email communications system: templates per event, custom email sending, sent email tracking
- Add staff/organizer profile pages with staff code display
- New DB tables: event_email_templates, sent_emails, user_communications
- New DB columns: staff.reminder_count/reminder_dates, breakout_session_organizers.presenter_code
- Expand English translation strings across all new features

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/staff/profile.html

@@ -0,0 +1,68 @@
+{% extends "base.html" %}
+
+{% block title %}{{ 'my_profile'|t }} - NetEvents{% endblock %}
+
+{% block content %}
+<div class="profile-page">
+    <h1>{{ 'my_profile'|t }}</h1>
+
+    <div class="profile-container">
+        <form method="POST" class="profile-form">
+            <div class="form-row">
+                <div class="form-group">
+                    <label for="first_name">{{ 'first_name'|t }}</label>
+                    <input type="text" id="first_name" name="first_name" value="{{ staff.first_name }}" required>
+                </div>
+
+                <div class="form-group">
+                    <label for="last_name">{{ 'last_name'|t }}</label>
+                    <input type="text" id="last_name" name="last_name" value="{{ staff.last_name }}" required>
+                </div>
+            </div>
+
+            <div class="form-group">
+                <label for="email">{{ 'email'|t }}</label>
+                <input type="email" id="email" name="email" value="{{ staff.email }}" required>
+            </div>
+
+            <div class="form-group">
+                <label for="preferred_language">{{ 'language'|t }}</label>
+                <select id="preferred_language" name="preferred_language">
+                    {% for lang in ['en', 'nl', 'de', 'fr', 'es', 'it', 'pl'] %}
+                        <option value="{{ lang }}" {% if staff.preferred_language == lang %}selected{% endif %}>{{ lang }}</option>
+                    {% endfor %}
+                </select>
+            </div>
+
+            <div class="form-row">
+                <div class="form-group">
+                    <label>{{ 'staff_code'|t }}</label>
+                    <input type="text" value="{{ staff.staff_code or '' }}" readonly class="input-readonly">
+                    <small class="text-muted">{{ 'staff_code_readonly'|t }}</small>
+                </div>
+
+                <div class="form-group">
+                    <label>{{ 'event'|t }}</label>
+                    <input type="text" value="{{ event_name or '' }}" readonly class="input-readonly">
+                </div>
+            </div>
+
+            <div class="form-row">
+                <div class="form-group">
+                    <label>{{ 'member_since'|t }}</label>
+                    <input type="text" value="{{ staff.created_at|localized_date if staff.created_at else '' }}" readonly class="input-readonly">
+                </div>
+
+                <div class="form-group">
+                    <label>{{ 'reminders_sent'|t }}</label>
+                    <input type="text" value="{{ staff.reminder_count or '0' }}" readonly class="input-readonly">
+                </div>
+            </div>
+
+            <div class="form-actions">
+                <button type="submit" class="btn btn-primary">{{ 'update_profile'|t }}</button>
+            </div>
+        </form>
+    </div>
+</div>
+{% endblock %}