Security hardening: env-based config, CSRF protection, secure code generation, plus presenter management and email communications system

- Move all credentials from hardcoded to .env with python-dotenv (add .env.example template and .gitignore)
- Add CSRF token generation and validation on all state-changing requests
- Replace random.choices with secrets.choice for all secure code generation
- Add session cookie security headers (HttpOnly, Secure, SameSite)
- Add presenter management: assign/remove presenters to breakout sessions, presenter QR scanning
- Add email communications system: templates per event, custom email sending, sent email tracking
- Add staff/organizer profile pages with staff code display
- New DB tables: event_email_templates, sent_emails, user_communications
- New DB columns: staff.reminder_count/reminder_dates, breakout_session_organizers.presenter_code
- Expand English translation strings across all new features

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/staff/staff_events.html

@@ -9,78 +9,33 @@
         <p>{{ 'welcome'|t }}, {{ staff_name }}</p>
     </div>
 
-    <div class="section-box">
+    <section class="section-box card">
         <h2>{{ 'select_event'|t }}</h2>
 
         {% if events %}
             <div class="events-list">
                 {% for event in events %}
-                <div class="event-card">
+                <div class="event-card card-static">
                     <div class="event-info">
                         <h3>{{ event.name }}</h3>
                         <p><strong>{{ 'location'|t }}:</strong> {{ event.location }}</p>
                         <p><strong>{{ 'start'|t }}:</strong> {{ event.start_time|localized_date if event.start_time else 'TBD' }}</p>
                     </div>
                     <div class="event-actions">
-                        <a href="{{ url_for('staff_event_dashboard', event_id=event.id) }}" class="btn btn-primary btn-lg">{{ 'start_qr_scanner'|t }}</a>
+                        <a href="{{ url_for('staff_event_dashboard', event_id=event.id) }}" class="btn btn-primary btn-lg"><i data-lucide="scan-line"></i> {{ 'start_qr_scanner'|t }}</a>
                     </div>
                 </div>
                 {% endfor %}
             </div>
         {% else %}
-            <p class="no-events">{{ 'no_events_assigned'|t }}</p>
+            <p class="no-events"><i data-lucide="calendar"></i> {{ 'no_events_assigned'|t }}</p>
         {% endif %}
-    </div>
+    </section>
 </div>
 
-<style>
-.staff-events-dashboard {
-    max-width: 800px;
-    margin: 0 auto;
-}
-
-.staff-header {
-    margin-bottom: 20px;
-}
-
-.staff-header h1 {
-    margin-bottom: 5px;
-}
-
-.events-list {
-    display: flex;
-    flex-direction: column;
-    gap: 15px;
-}
-
-.event-card {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    padding: 20px;
-    background: #f8f9fa;
-    border-radius: 8px;
-    border: 1px solid #e9ecef;
-}
-
-.event-info h3 {
-    margin: 0 0 10px 0;
-}
-
-.event-info p {
-    margin: 5px 0;
-    color: #666;
-}
-
-.event-actions {
-    flex-shrink: 0;
-    margin-left: 20px;
-}
-
-.no-events {
-    text-align: center;
-    color: #666;
-    padding: 40px;
-}
-</style>
-{% endblock %}
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+    lucide.createIcons();
+});
+</script>
+{% endblock %}