The CSRF failure on /import/upload used one generic message. It now tells
apart an empty upload, a missing token, and a session mismatch.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Business prospecting tool for a 9x12 postcard business:
- Import businesses from CSV/XLSX/XLS with column mapping and phone/email de-duplication
- Searchable, filterable, sortable business list with CSV export
- Business detail: log calls/emails/visits/mailings, follow-up dates, notes, edit,
  duplicate warning, remove/restore, previous-customer flag
- Today follow-up queue (home page), dashboard of counts, industries management
- Access (.accdb) database built by migrations; scripts for ADOX database creation and
  32-bit migration runs
- Core fixes: route parameters are no longer concatenated into executed code (mvc.asp);
  GetAntiCSRFToken returns the token on first use (lib.HTML.Security.asp)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>