fix(manager): harden file manager tokens, media browser CSRF and alert output

[elcreator]

• makeToken() built the file manager's one-shot token from uniqid(), which is clock-derived; it now uses random_bytes() and checkToken() compares with hash_equals().
• The media browser (mcpuk) had no CSRF check at all and relied on SameSite. browse.php now requires the session _token for every act except the page itself and its thumbnails; the scripts append it through baseGetData(), the single place every request URL is built.
• webAlertAndQuit() wrote its message into the alert page verbatim, so any caller interpolating request data was reflected XSS. The message is shown as plain text (it is read via textContent and removed), so it is escaped now.
• ?stay= and ?tab= are only ever small integers: cast them before they reach Location headers and a script block.
• Default upload_files/upload_images no longer list svg, htaccess or flash extensions; svg is scriptable and served same-origin, which gave the assets_files right a stored XSS. Only new installs pick the defaults up.