Security: Fix critical vulnerabilities and implement security hardening

CRITICAL SECURITY FIXES:
- Fixed certificate validation bypass vulnerability in BTCPayServerService
  * Removed unsafe ServerCertificateCustomValidationCallback
  * Added environment-specific SSL configuration
  * Production now enforces proper SSL validation

- Fixed overly permissive CORS policy
  * Replaced AllowAnyOrigin() with specific trusted origins
  * Created separate CORS policies for Development/Production/API
  * Configured from appsettings for environment-specific control

- Implemented CSRF protection across admin panel
  * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions
  * Protected 10 admin controllers with anti-forgery tokens
  * Prevents Cross-Site Request Forgery attacks

CONFIGURATION IMPROVEMENTS:
- Created appsettings.Development.json for dev-specific settings
- Added Security:AllowInsecureSSL flag (Development only)
- Added CORS:AllowedOrigins configuration arrays
- Created comprehensive security roadmap (ROADMAP.md)

ALSO FIXED:
- TeleBot syntax errors (Program.cs, MessageFormatter.cs)
- Added enterprise-full-stack-developer output style

Impact: All Phase 1 critical security vulnerabilities resolved
Status: Ready for security review and deployment preparation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

LittleShop/Services/BTCPayServerService.cs

@@ -33,12 +33,27 @@ public class BTCPayServerService : IBTCPayServerService
 
         _logger.LogInformation("Initializing BTCPay Server connection to {BaseUrl} with Store ID: {StoreId}", _baseUrl, _storeId);
 
-        // Create HttpClient with certificate bypass for internal networks
-        var httpClient = new HttpClient(new HttpClientHandler()
-        {
-            ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
-        });
+        // Create HttpClient with proper SSL validation
+        var httpClientHandler = new HttpClientHandler();
 
+        // Only allow insecure SSL in development mode with explicit configuration
+        var allowInsecureSSL = _configuration.GetValue<bool>("Security:AllowInsecureSSL", false);
+        if (allowInsecureSSL)
+        {
+            var environment = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");
+            if (environment == "Development")
+            {
+                _logger.LogWarning("SECURITY WARNING: SSL certificate validation is disabled for development. This should NEVER be used in production!");
+                httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true;
+            }
+            else
+            {
+                _logger.LogError("Attempted to disable SSL certificate validation in non-development environment. This is not allowed.");
+                throw new InvalidOperationException("SSL certificate validation cannot be disabled in production environments");
+            }
+        }
+
+        var httpClient = new HttpClient(httpClientHandler);
         _client = new BTCPayServerClient(new Uri(_baseUrl), apiKey, httpClient);
     }