Improve Authentication Security & Configuration

## Description

The current authentication system is working as a prototype, but there are several security and configuration issues that should be addressed before treating it as production-ready.

These fixes were intentionally deferred from the current prototype PR so they can be handled separately.

## Tasks

### Authentication Security

* [ ] **Regenerate session ID after login**

* Add `session_regenerate_id(true)` after successful authentication.
* Prevent session fixation attacks.

* [ ] **Add CSRF protection**

* Add CSRF tokens to login and register forms.
* Validate tokens server-side.
* Change logout from `GET` to `POST`.
* Protect other authentication-related POST requests where necessary.

* [ ] **Validate Google's `email_verified`**

* Require Google's `email_verified` value to be `true`.
* Do not treat a missing value as verified.
* Review the Google account-linking flow while making this change.

### 🔧 Configuration & Error Handling

* [ ] **Fix `config.local.php` loading**

* Make `config.local.php` optional.
* Prevent errors when the file does not exist on a fresh clone.
* Load local configuration before defining default values.
* Allow local configuration values to override defaults.

* [ ] **Hide raw database errors**

* Stop displaying raw database connection errors to users.
* Log the actual error for debugging.
* Display a generic error message to the user.

### 🧹 Additional Cleanup

* [ ] **Review `sanitize()`**

* Separate input validation from HTML escaping.
* Validate/normalize data before storing it.
* Use HTML escaping when outputting data.

* [ ] **Fix the Forgot Password link**

* Either implement `reset-password.php`
* Or remove/disable the link until the feature exists.

## Testing Checklist

After implementing the fixes:

* [ ] Normal login still works.
* [ ] Registration still works.
* [ ] Google login still works.
* [ ] Google callback still works.
* [ ] Logout works using POST.
* [ ] Invalid/missing CSRF tokens are rejected.
* [ ] Sessions are regenerated after successful login.
* [ ] Fresh clone works without `config.local.php`.
* [ ] Database errors are not exposed to users.
* [ ] No OAuth credentials are committed to Git.
* [ ] Forgot Password link no longer leads to a missing page.

## Notes

This issue is intended as a follow-up to the prototype authentication update.

The goal is **not** to completely refactor the authentication system. Keep the existing structure where possible and focus on fixing the identified security, configuration, and obvious functionality issues.

Empieza rastreando los formularios de inicio de sesión y registro, el callback de Google y el flujo de vinculación de cuentas, el endpoint de cierre de sesión, la carga de config.local.php, el manejo de errores de la base de datos y el enlace de recuperación de contraseña a reset-password.php. Usa la lista de comprobación de pruebas como primera ronda de validación; terminado significa que los comportamientos de autenticación, configuración, visualización de errores, sanitización y enlaces indicados funcionan sin exponer credenciales ni errores sin procesar.

Escrito por el modelo de indexación a partir del texto del issue.