fix(admin): verify CSRF token in alliance/medal admin Mods [#139] (#261)

editAli, delAli, medals, delallymedal, delallymedalbyaid, delallymedalbyweek
and deletemedalbyweek are POSTed to directly, bypassing admin.php's central
csrf_verify(). Add csrf_verify() (after the admin access check, via the shared
GameEngine/Admin/csrf.php) and csrf_field() in their forms (playermedals.tpl,
editAli.tpl, delAli.tpl, delmedal.tpl, allymedals.tpl, delallymedal.tpl).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Admin/Templates/delAli.tpl

@@ -44,6 +44,7 @@ $members = $database->getAllMember($aid);
         <div class="warn">⚠ All members will be removed from the alliance, permissions, diplomacy, logs and the alliance forum will be deleted. The action is irreversible!</div>
 
         <form method="POST" action="../GameEngine/Admin/Mods/delAli.php" onsubmit="return confirm('Last warning: DELETE PERMANENTLY?');">
+            <?php echo csrf_field(); ?>
             <input type="hidden" name="aid" value="<?php echo $aid;?>">
             <input type="hidden" name="admid" value="<?php echo $_SESSION['id'];?>">
             <button type="submit" class="btn del">YES, DELETE</button>