Fix security vulnerabilities and code quality issues

[HaardenShah]

Summary

• Fix broken player delete by adding missing CSRF token to fetch request
• Fix XSS vulnerabilities via innerHTML in live.php and schedule-match.php
• Add session.cookie_secure flag to prevent cookie leakage over HTTP
• Validate custom date range inputs with DateTime::createFromFormat
• Replace insecure mt_rand with random_bytes/random_int for UUID and player code generation
• Cache redundant method calls in Database::getStats()
• Escape $messageType in HTML class attributes across admin pages

Test plan

• Verify player delete works correctly in admin panel (was previously silently broken)
• Verify live score error messages display correctly
• Verify scheduled matches list renders properly
• Verify custom date filtering works on stats pages
• Verify new player registration generates valid UUIDs

🤖 Generated with Claude Code

[HaardenShah]

Code review

Found 1 issue:

1. session.cookie_secure set unconditionally to 1 will break authentication on HTTP deployments. The app supports local/LAN HTTP installs (the README and setup wizard assume this), and the rest of the codebase already checks HTTPS conditionally (e.g., InstallCheck.php uses isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on'). With cookie_secure=1, the session cookie is never sent over HTTP, silently breaking all admin logins. Fix: make it conditional on HTTPS detection.

StumpVision/api/lib/SessionConfig.php

Lines 17 to 19 in 0c20105

	ini_set('session.cookie_samesite', 'Lax');
	ini_set('session.cookie_secure', '1');

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}