Fix tenant event form package selector so it no longer renders empty-value options, handles loading/empty

states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
    (resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
  - Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
    routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
    resources/js/admin/router.tsx, routes/web.php)

config/join_tokens.php

@@ -0,0 +1,12 @@
+<?php
+
+return [
+    'failure_limit' => (int) env('JOIN_TOKEN_FAILURE_LIMIT', 10),
+    'failure_decay_minutes' => (int) env('JOIN_TOKEN_FAILURE_DECAY', 5),
+
+    'access_limit' => (int) env('JOIN_TOKEN_ACCESS_LIMIT', 120),
+    'access_decay_minutes' => (int) env('JOIN_TOKEN_ACCESS_DECAY', 1),
+
+    'download_limit' => (int) env('JOIN_TOKEN_DOWNLOAD_LIMIT', 60),
+    'download_decay_minutes' => (int) env('JOIN_TOKEN_DOWNLOAD_DECAY', 1),
+];

config/oauth.php

@@ -8,6 +8,7 @@ return [
     'refresh_tokens' => [
         'enforce_ip_binding' => env('OAUTH_REFRESH_ENFORCE_IP', true),
         'allow_subnet_match' => env('OAUTH_REFRESH_ALLOW_SUBNET', false),
+        'max_active_per_tenant' => env('OAUTH_REFRESH_MAX_ACTIVE', 5),
+        'audit_retention_days' => env('OAUTH_REFRESH_AUDIT_RETENTION_DAYS', 90),
     ],
 ];
-

config/security.php

@@ -0,0 +1,17 @@
+<?php
+
+return [
+    'antivirus' => [
+        'enabled' => env('SECURITY_AV_ENABLED', false),
+        'binary' => env('SECURITY_AV_BINARY', '/usr/bin/clamscan'),
+        'arguments' => env('SECURITY_AV_ARGUMENTS', '--no-summary'),
+        'timeout' => (int) env('SECURITY_AV_TIMEOUT', 60),
+    ],
+    'exif' => [
+        'strip' => env('SECURITY_STRIP_EXIF', true),
+    ],
+    'queue' => [
+        'name' => env('SECURITY_SCAN_QUEUE', 'media-security'),
+    ],
+];
+