fix: replace Auth::csrfField() with Auth::csrfToken() in all views

csrfField() doesn't exist — the actual pattern is a hidden input
with name="_csrf" and value from Auth::csrfToken().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/notifications/views/campaign_detail.php

@@ -57,12 +57,12 @@
     <div class="flex gap-3 mt-5">
         <?php if (($campaign['status'] ?? '') === 'scheduled'): ?>
         <form method="POST" action="/notifications/scheduled/<?= $campaign['id'] ?>/cancel">
-            <?= Auth::csrfField() ?>
+            <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
             <button type="submit" class="btn btn-danger btn-sm" onclick="return confirm('إلغاء؟')">إلغاء الجدولة</button>
         </form>
         <?php endif; ?>
         <form method="POST" action="/notifications/<?= $campaign['id'] ?>/delete">
-            <?= Auth::csrfField() ?>
+            <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
             <button type="submit" class="btn btn-ghost btn-sm" style="color:var(--danger)" onclick="return confirm('حذف نهائي؟')">حذف</button>
         </form>
     </div>

modules/notifications/views/compose.php

@@ -8,7 +8,7 @@
     <div>
         <div class="card p-6">
             <form id="push-form" method="POST" action="/notifications/compose/send">
-                <?= Auth::csrfField() ?>
+                <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
 
                 <!-- Template Select -->
                 <div class="form-group mb-4">

modules/notifications/views/individual.php

@@ -6,7 +6,7 @@
 <div style="max-width:700px;">
     <div class="card p-6">
         <form method="POST" action="/notifications/individual/send">
-            <?= Auth::csrfField() ?>
+            <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
 
             <!-- Player Search -->
             <div class="form-group mb-4">

modules/notifications/views/scheduled.php

@@ -18,7 +18,7 @@
                 <td><span class="badge badge-info"><?= match($s['type'] ?? '') { 'broadcast' => 'بث عام', 'demographic' => 'فئة', default => $s['type'] ?? '-' } ?></span></td>
                 <td>
                     <form method="POST" action="/notifications/scheduled/<?= $s['id'] ?>/cancel" style="display:inline;">
-                        <?= Auth::csrfField() ?>
+                        <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
                         <button type="submit" class="btn btn-ghost btn-sm" style="color:var(--danger)" onclick="return confirm('إلغاء؟')">إلغاء</button>
                     </form>
                 </td>

modules/notifications/views/template_form.php

@@ -6,7 +6,7 @@
 <div style="max-width:600px;">
     <div class="card p-6">
         <form method="POST" action="<?= $template ? "/notifications/templates/{$template['id']}/update" : '/notifications/templates/store' ?>">
-            <?= Auth::csrfField() ?>
+            <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
 
             <div class="form-group mb-4">
                 <label class="form-label">اسم القالب <span class="text-danger">*</span></label>

modules/notifications/views/templates.php

@@ -22,7 +22,7 @@
                     <td class="flex gap-2">
                         <a href="/notifications/templates/<?= $t['id'] ?>/edit" class="btn btn-ghost btn-sm">تعديل</a>
                         <form method="POST" action="/notifications/templates/<?= $t['id'] ?>/delete" style="display:inline;">
-                            <?= Auth::csrfField() ?>
+                            <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">
                             <button type="submit" class="btn btn-ghost btn-sm" style="color:var(--danger)" onclick="return confirm('حذف؟')">حذف</button>
                         </form>
                     </td>