feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/alerts/list.html

@@ -33,7 +33,7 @@
                 <td style="color:var(--text-muted);">{{ rule.metric_name }} {{ rule.operator.value }} {{ rule.threshold }}</td>
                 <td class="td-actions">
                     {% if state.state.value == 'firing' %}
-                    <form method="post" action="/alerts/{{ rule.id }}/acknowledge" style="display:inline;">
+                    <form method="post" action="/alerts/{{ rule.id }}/acknowledge" style="display:inline;">{{ csrf_field() }}
                         <button type="submit" class="btn btn-sm btn-warn">Acknowledge</button>
                     </form>
                     {% endif %}
@@ -83,12 +83,12 @@
                 <td style="color:var(--text-muted);text-align:center;">{{ rule.consecutive_failures_required }}</td>
                 <td class="td-actions">
                     <a href="/alerts/rules/{{ rule.id }}/edit" class="btn btn-sm btn-ghost">Edit</a>
-                    <form method="post" action="/alerts/rules/{{ rule.id }}/toggle" style="display:inline;">
+                    <form method="post" action="/alerts/rules/{{ rule.id }}/toggle" style="display:inline;">{{ csrf_field() }}
                         <button type="submit" class="btn btn-sm btn-ghost">
                           {% if rule.enabled %}Disable{% else %}Enable{% endif %}
                         </button>
                     </form>
-                    <form method="post" action="/alerts/rules/{{ rule.id }}/delete" style="display:inline;">
+                    <form method="post" action="/alerts/rules/{{ rule.id }}/delete" style="display:inline;">{{ csrf_field() }}
                         <button type="submit" class="btn btn-sm btn-danger"
                             onclick="return confirm('Delete rule {{ rule.name }}?')">Delete</button>
                     </form>