Consolidate schema, add CSRF protection, and add login rate-limiting

Six fixes from a codebase review:

- Consolidate the ad hoc install.php + migrate_v2..v6.php chain into one
  canonical schema.sql (structure reference) plus a simplified install.php
  that creates all tables and seeds site_settings, the superadmin account,
  and the standard prayer library. The six migrate_v*.php scripts are
  deleted — their cumulative effect is now fully captured in schema.sql.

- Delete the two root-level setup.php/novena_group.php files that existed
  only to redirect to their admin/ equivalents of the same name; confirmed
  unreferenced by any link or .htaccess rule.

- Decouple includes/build_slides.php from data/prayers.php's implicit
  `global $opening, $mysteries, ...` contract. data/prayers.php now
  explicitly returns its arrays; build_slides.php loads them through a
  small memoized get_prayer_data() and destructures them by key.

- Add CSRF protection (includes/csrf.php: csrf_token/csrf_field/csrf_verify)
  across every POST-handling endpoint — 10 form pages and 7 API endpoints —
  plus token wiring in the JS/inline scripts that call the FormData- and
  JSON-body API endpoints (builder.js, setup.js, and the inline scripts in
  admin/audio.php, admin/novena_group.php, and index.php).

- Stop round-tripping the SMTP password in plaintext through the settings
  form: the field now renders blank with a "currently set" hint, and a
  blank submission leaves the stored password unchanged instead of
  clearing it.

- Add login rate-limiting: users.failed_login_attempts / locked_until
  columns, is_locked_out()/record_login_failure()/record_login_success()
  helpers in includes/auth.php, and lockout handling in login.php (5
  failed attempts locks the account for 15 minutes). README documents the
  one manual ALTER TABLE needed to add these columns to an existing
  production database.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -32,10 +32,12 @@ cp config/db.example.php config/db.php
 
 ### 2. Create the database schema
 
-Visit `install.php` in your browser once to create all tables and seed the superadmin account. **Delete `install.php` immediately after.**
+Visit `install.php` in your browser once — it creates all tables (matching `schema.sql`, kept as the canonical structure reference) and seeds `site_settings` defaults, the superadmin account, and the standard prayer library. **Delete `install.php` immediately after.**
 
 Default superadmin credentials: `supadmin` / `supadmin` — **change these immediately**.
 
+`schema.sql` documents the current database structure; there is no separate migration-script chain to run.
+
 ### 3. Configure the web server
 
 #### Apache — `.htaccess` is included. Enable `mod_rewrite` and set `AllowOverride All`.
@@ -62,6 +64,16 @@ chmod 755 uploads/
 
 Configure outbound email in **Admin → Settings** for registration confirmation and password reset emails. If left blank, the app will auto-confirm new users instead.
 
+## Upgrading an Existing Install
+
+`schema.sql` reflects the current database structure. For a production database that predates the `failed_login_attempts` / `locked_until` login-lockout columns, run this once against it manually — it's not applied automatically since there's no migration runner against a live database:
+
+```sql
+ALTER TABLE users
+    ADD COLUMN failed_login_attempts INT NOT NULL DEFAULT 0,
+    ADD COLUMN locked_until DATETIME NULL;
+```
+
 ## Deployment Checklist
 
 - [ ] `config/db.php` filled in with production credentials
@@ -92,7 +104,8 @@ Rosary/
 ├── data/
 │   └── prayers.php     # All prayer text + build_decade_slides()
 ├── includes/
-│   ├── auth.php        # require_auth(), current_user(), has_role()
+│   ├── auth.php        # require_auth(), current_user(), has_role(), login lockout
+│   ├── csrf.php        # csrf_token(), csrf_field(), csrf_verify()
 │   ├── build_slides.php
 │   ├── donate.php
 │   └── mailer.php
@@ -100,6 +113,7 @@ Rosary/
 ├── index.php           # Public home — card grid of sessions
 ├── present.php         # Presentation player (public)
 ├── novena_public.php   # Novena day-picker (public)
+├── schema.sql          # Canonical database schema (structure only)
 ├── install.php         # Run once, then delete
 └── .htaccess           # URL rewriting
 ```