Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/admin/emails/page.tsx

@@ -1047,6 +1047,7 @@ export default function AdminEmailsPage() {
             <div className="flex-1 overflow-auto">
               <iframe
                 srcDoc={previewHtml}
+                sandbox=""
                 className="w-full h-full min-h-[500px]"
                 title="Email Preview"
               />
@@ -1100,6 +1101,7 @@ export default function AdminEmailsPage() {
               {selectedLog.bodyHtml ? (
                 <iframe
                   srcDoc={selectedLog.bodyHtml}
+                  sandbox=""
                   className="w-full h-full min-h-[400px]"
                   title="Email Content"
                 />

frontend/src/app/admin/events/[id]/page.tsx

@@ -2217,7 +2217,7 @@ export default function AdminEventDetailPage() {
               <Button variant="outline" size="sm" onClick={() => setPreviewHtml(null)} className="min-h-[44px] md:min-h-0">Close</Button>
             </div>
             <div className="flex-1 overflow-auto">
-              <iframe srcDoc={previewHtml} className="w-full h-full min-h-[500px]" title="Email Preview" />
+              <iframe srcDoc={previewHtml} sandbox="" className="w-full h-full min-h-[500px]" title="Email Preview" />
             </div>
           </Card>
         </div>