Fix tenant event form package selector so it no longer renders empty-value options, handles loading/empty

states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
    (resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
  - Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
    routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
    resources/js/admin/router.tsx, routes/web.php)

docs/queue-supervisor/README.md

@@ -45,6 +45,19 @@ services:
       QUEUE_SLEEP: 5
     command: >
       /var/www/html/docs/queue-supervisor/queue-worker.sh media-storage
+
+  media-security-worker:
+    image: fotospiel-app
+    restart: unless-stopped
+    depends_on:
+      - redis
+    environment:
+      APP_ENV: ${APP_ENV:-production}
+      QUEUE_CONNECTION: redis
+      QUEUE_TRIES: 3
+      QUEUE_SLEEP: 5
+    command: >
+      /var/www/html/docs/queue-supervisor/queue-worker.sh media-security
 ```
 
 Scale workers by increasing `deploy.replicas` (Swarm) or adding `scale` counts (Compose v2).
@@ -74,6 +87,7 @@ Expose Horizon via your web proxy and protect it with authentication (the app al
 - `QUEUE_CONNECTION` — should match the driver configured in `.env` (`redis` recommended).
 - `QUEUE_TRIES`, `QUEUE_SLEEP`, `QUEUE_TIMEOUT`, `QUEUE_MAX_TIME` — optional tuning knobs consumed by `queue-worker.sh`.
 - `STORAGE_ALERT_EMAIL` — enables upload failure notifications introduced in the new storage pipeline.
+- `SECURITY_SCAN_QUEUE` — overrides the queue name for the photo antivirus/EXIF worker (`media-security` by default).
 - Redis / database credentials must be available in the worker containers exactly like the web container.
 
 ### 5. Bootstrapping reminder