Fix tenant event form package selector so it no longer renders empty-value options, handles loading/empty

states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
    (resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
  - Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
    routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
    resources/js/admin/router.tsx, routes/web.php)

app/Providers/AppServiceProvider.php

@@ -8,6 +8,7 @@ use App\Services\Checkout\CheckoutSessionService;
 use App\Notifications\UploadPipelineFailed;
 use App\Services\Storage\EventStorageManager;
 use App\Services\Storage\StorageHealthService;
+use App\Services\Security\PhotoSecurityScanner;
 use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Http\Request;
 use Illuminate\Queue\Events\JobFailed;
@@ -29,6 +30,7 @@ class AppServiceProvider extends ServiceProvider
         $this->app->singleton(CheckoutPaymentService::class);
         $this->app->singleton(EventStorageManager::class);
         $this->app->singleton(StorageHealthService::class);
+        $this->app->singleton(PhotoSecurityScanner::class);
     }
 
     /**
@@ -73,6 +75,26 @@ class AppServiceProvider extends ServiceProvider
             ];
         });
 
+        Inertia::share('security', static function () {
+            $request = request();
+
+            if (! $request) {
+                return [
+                    'csp' => [
+                        'scriptNonce' => null,
+                        'styleNonce' => null,
+                    ],
+                ];
+            }
+
+            return [
+                'csp' => [
+                    'scriptNonce' => $request->attributes->get('csp_script_nonce'),
+                    'styleNonce' => $request->attributes->get('csp_style_nonce'),
+                ],
+            ];
+        });
+
         if (config('storage-monitor.queue_failure_alerts')) {
             Queue::failing(function (JobFailed $event) {
                 $context = [