Security: Fix critical vulnerabilities and implement security hardening

CRITICAL SECURITY FIXES:
- Fixed certificate validation bypass vulnerability in BTCPayServerService
  * Removed unsafe ServerCertificateCustomValidationCallback
  * Added environment-specific SSL configuration
  * Production now enforces proper SSL validation

- Fixed overly permissive CORS policy
  * Replaced AllowAnyOrigin() with specific trusted origins
  * Created separate CORS policies for Development/Production/API
  * Configured from appsettings for environment-specific control

- Implemented CSRF protection across admin panel
  * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions
  * Protected 10 admin controllers with anti-forgery tokens
  * Prevents Cross-Site Request Forgery attacks

CONFIGURATION IMPROVEMENTS:
- Created appsettings.Development.json for dev-specific settings
- Added Security:AllowInsecureSSL flag (Development only)
- Added CORS:AllowedOrigins configuration arrays
- Created comprehensive security roadmap (ROADMAP.md)

ALSO FIXED:
- TeleBot syntax errors (Program.cs, MessageFormatter.cs)
- Added enterprise-full-stack-developer output style

Impact: All Phase 1 critical security vulnerabilities resolved
Status: Ready for security review and deployment preparation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

TeleBot/TeleBot/Program.cs

@@ -15,7 +15,7 @@ using TeleBot.Handlers;
 using TeleBot.Services;
 
 var builder = Host.CreateApplicationBuilder(args);
-public static string BrandName ?? "Little Shop";
+var BrandName = "Little Shop";
 // Configuration
 builder.Configuration
     .SetBasePath(Directory.GetCurrentDirectory())

TeleBot/TeleBot/UI/MessageFormatter.cs

@@ -275,7 +275,7 @@ namespace TeleBot.UI
                    "/cancel - Cancel current operation\n" +
                    "/delete - Delete all your data\n" +
                    "/tor - Get Tor onion address\n" +
-                   "/help - Show this help message\n\n"
+                   "/help - Show this help message\n\n";
         }
         
         public static string FormatPrivacyPolicy()