feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/ai_access/index.html

@@ -59,7 +59,7 @@
             <td class="td-actions">
               {% if row.state == 'active' %}
               <form method="post" action="/ai-access/tokens/{{ t.id }}/revoke" style="margin:0;"
-                    onsubmit='return confirm({{ ("Revoke “" ~ t.name ~ "”? Any client using it stops working immediately.")|tojson }})'>
+                    onsubmit='return confirm({{ ("Revoke “" ~ t.name ~ "”? Any client using it stops working immediately.")|tojson }})'>{{ csrf_field() }}
                 <button type="submit" class="btn btn-danger btn-sm">Revoke</button>
               </form>
               {% endif %}
@@ -79,7 +79,7 @@
   <div>
     <div class="section-title" style="margin-bottom:0.75rem;">Create a token</div>
     <div class="card" style="margin-bottom:0;">
-      <form method="post" action="/ai-access/tokens">
+      <form method="post" action="/ai-access/tokens">{{ csrf_field() }}
         <div class="form-group">
           <label for="tok-name">Name</label>
           <input type="text" id="tok-name" name="name" required maxlength="128"