Import: say why the upload form-state check failed

The CSRF failure on /import/upload used one generic message. It now tells
apart an empty upload, a missing token, and a session mismatch.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/controllers/ImportController.asp

@@ -47,7 +47,13 @@ Class ImportController_Class
         up.Upload
 
         If Not Csrf_Valid("import", up.Form("csrf")) Then
-            Flash().AddError "Invalid form state. Please try again."
+            If up.FormElements.Count = 0 Then
+                Flash().AddError "Invalid form state: the upload was not received (" & Request.TotalBytes & " bytes). Please try again."
+            ElseIf Len(up.Form("csrf")) = 0 Then
+                Flash().AddError "Invalid form state: the form token was missing from the upload. Please try again."
+            Else
+                Flash().AddError "Invalid form state: your session expired or changed. Reload this page and try again."
+            End If
             Response.Redirect "/import"
         End If