fix(admin): verify CSRF token in message admin Mods [#139] (#264)

sendMessage, massmessage and sysmessage are POSTed to directly, bypassing
admin.php's central csrf_verify(). Add csrf_verify() (after the admin access
check, via the shared GameEngine/Admin/csrf.php) and csrf_field() in their
forms (Newmessage.tpl, massmessage.tpl, sysmessage.tpl; the mass/sys templates
have both a prepare and an execute form).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Admin/Templates/Newmessage.tpl

@@ -54,6 +54,7 @@ $user = $database->getUserArray($id,1);
     </div>
     
     <form method="post" action="../GameEngine/Admin/Mods/sendMessage.php" name="msg">
+      <?php echo csrf_field(); ?>
       <div class="msg-body">
         <input type="hidden" name="uid" value="<?php echo $id; ?>">