The CSRF failure on /import/upload used one generic message. It now tells
apart an empty upload, a missing token, and a session mismatch.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

New /bulk-log page: paste emails (semicolon/comma/newline separated), choose
method, outcome, contact date and a follow-up date, review the matches, then
log the contact on every matching non-removed business. Reuses
BusinessRepository.LogInteraction so status and next-contact date update the
same way as the single-business form.

Registers bulklogcontroller in the core controller whitelist.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- New areas and business_areas tables (migration 20261025120001).
- /areas page to add, rename, merge and delete areas (AreasController,
  AreaRepository), registered in the controller allow-list and nav.
- Business detail: area badges, tick existing areas or add new ones
  (comma-separated) when saving details.
- Businesses list: Area filter (any / none / specific) and a sortable
  Areas column (sorts by each business's first area alphabetically).
- CSV export: Areas column; respects the area filter.
- Area ids inside subqueries are inlined as CLng because Access binds
  ? markers in subqueries ahead of outer ones.
- run_site.cmd: use 64-bit IIS Express to match the installed 64-bit
  ACE provider (fixes "Provider cannot be found", 3706).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Business prospecting tool for a 9x12 postcard business:
- Import businesses from CSV/XLSX/XLS with column mapping and phone/email de-duplication
- Searchable, filterable, sortable business list with CSV export
- Business detail: log calls/emails/visits/mailings, follow-up dates, notes, edit,
  duplicate warning, remove/restore, previous-customer flag
- Today follow-up queue (home page), dashboard of counts, industries management
- Access (.accdb) database built by migrations; scripts for ADOX database creation and
  32-bit migration runs
- Core fixes: route parameters are no longer concatenated into executed code (mvc.asp);
  GetAntiCSRFToken returns the token on first use (lib.HTML.Security.asp)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>