feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/ansible/browse.html

@@ -28,7 +28,7 @@
             {% if view_editable and session.user_role == 'admin' %}
             <a href="/ansible/playbooks/edit/{{ view_source }}/{{ view_path }}" class="btn btn-sm">Edit</a>
             <form method="post" action="/ansible/playbooks/delete" style="display:inline;"
-                  onsubmit="return confirm('Delete {{ view_path }}?');">
+                  onsubmit="return confirm('Delete {{ view_path }}?');">{{ csrf_field() }}
                 <input type="hidden" name="source_name" value="{{ view_source }}">
                 <input type="hidden" name="playbook_path" value="{{ view_path }}">
                 <button type="submit" class="btn btn-sm btn-danger">Delete</button>

steward/templates/ansible/inventory/group_detail.html

@@ -7,7 +7,7 @@
     <h1 class="page-title" style="margin-bottom:0;">Group: {{ group.name }}</h1>
 </div>
 
-<form method="post" action="/ansible/inventory/groups/{{ group.id }}">
+<form method="post" action="/ansible/inventory/groups/{{ group.id }}">{{ csrf_field() }}
     <div class="card" style="margin-bottom:1.5rem;">
         <h3 class="section-title">Settings</h3>
         <div class="form-group">

steward/templates/ansible/inventory/groups.html

@@ -12,7 +12,7 @@
 
 <div class="card" style="margin-bottom:1.5rem;">
     <h3 class="section-title">New Group</h3>
-    <form method="post" action="/ansible/inventory/groups" style="display:flex;gap:0.75rem;align-items:flex-end;">
+    <form method="post" action="/ansible/inventory/groups" style="display:flex;gap:0.75rem;align-items:flex-end;">{{ csrf_field() }}
         <div class="form-group" style="flex:1;margin:0;">
             <label>Name</label>
             <input type="text" name="name" placeholder="webservers" required>
@@ -38,7 +38,7 @@
         <td style="color:var(--text-muted);font-size:0.9rem;">{{ grp.targets | length }}</td>
         <td class="td-actions">
             <a href="/ansible/inventory/groups/{{ grp.id }}" class="btn btn-sm btn-ghost">Edit</a>
-            <form method="post" action="/ansible/inventory/groups/{{ grp.id }}/delete" style="display:inline;">
+            <form method="post" action="/ansible/inventory/groups/{{ grp.id }}/delete" style="display:inline;">{{ csrf_field() }}
                 <button type="submit" class="btn btn-sm btn-danger"
                         onclick="return confirm('Delete group {{ grp.name }}?')">×</button>
             </form>

steward/templates/ansible/inventory/target_detail.html

@@ -7,7 +7,7 @@
     <h1 class="page-title" style="margin-bottom:0;">Target: {{ target.name }}</h1>
 </div>
 
-<form method="post" action="/ansible/inventory/targets/{{ target.id }}">
+<form method="post" action="/ansible/inventory/targets/{{ target.id }}">{{ csrf_field() }}
     <div class="card" style="margin-bottom:1.5rem;">
         <h3 class="section-title">Connection</h3>
         <div class="form-group">

steward/templates/ansible/inventory/targets.html

@@ -12,7 +12,7 @@
 
 <div class="card" style="margin-bottom:1.5rem;">
     <h3 class="section-title">New Target</h3>
-    <form method="post" action="/ansible/inventory/targets" style="display:flex;gap:0.75rem;align-items:flex-end;">
+    <form method="post" action="/ansible/inventory/targets" style="display:flex;gap:0.75rem;align-items:flex-end;">{{ csrf_field() }}
         <div class="form-group" style="flex:1;margin:0;">
             <label>Name <span style="color:var(--text-muted);font-weight:normal;font-size:0.82rem;">(used as Ansible hostname)</span></label>
             <input type="text" name="name" placeholder="webserver-01" required>
@@ -47,7 +47,7 @@
         </td>
         <td class="td-actions">
             <a href="/ansible/inventory/targets/{{ tgt.id }}" class="btn btn-sm btn-ghost">Edit</a>
-            <form method="post" action="/ansible/inventory/targets/{{ tgt.id }}/delete" style="display:inline;">
+            <form method="post" action="/ansible/inventory/targets/{{ tgt.id }}/delete" style="display:inline;">{{ csrf_field() }}
                 <button type="submit" class="btn btn-sm btn-danger"
                         onclick="return confirm('Delete target {{ tgt.name }}?')">×</button>
             </form>

steward/templates/ansible/playbook_editor.html

@@ -15,7 +15,7 @@
   automatically; you can also configure a local-dir source under <a href="/settings/ansible/">Settings → Ansible</a>.
 </div>
 {% else %}
-<form method="post" action="/ansible/playbooks/save">
+<form method="post" action="/ansible/playbooks/save">{{ csrf_field() }}
   <input type="hidden" name="editing" value="{{ '1' if editing else '0' }}">
   <div style="display:flex;gap:1rem;flex-wrap:wrap;margin-bottom:1rem;">
     <div class="form-group" style="margin-bottom:0;">
@@ -54,7 +54,7 @@
 
 {% if editing %}
 <form method="post" action="/ansible/playbooks/delete" style="margin-top:1rem;"
-      onsubmit="return confirm('Delete {{ playbook_path }}?');">
+      onsubmit="return confirm('Delete {{ playbook_path }}?');">{{ csrf_field() }}
   <input type="hidden" name="source_name" value="{{ source_name }}">
   <input type="hidden" name="playbook_path" value="{{ playbook_path }}">
   <button type="submit" class="btn btn-danger btn-sm">Delete playbook</button>

steward/templates/ansible/run_detail.html

@@ -7,7 +7,7 @@
     <h1 class="page-title" style="margin-bottom:0;">Run Detail</h1>
     <div style="margin-left:auto;display:flex;gap:0.5rem;">
         {% if run.status.value in ("running", "queued") and session.user_role in ("operator", "admin") %}
-        <form method="post" action="/ansible/runs/{{ run.id }}/cancel" onsubmit="return confirm('Cancel this run?');">
+        <form method="post" action="/ansible/runs/{{ run.id }}/cancel" onsubmit="return confirm('Cancel this run?');">{{ csrf_field() }}
             <button type="submit" class="btn btn-sm btn-danger">Cancel run</button>
         </form>
         {% endif %}

steward/templates/ansible/schedules.html

@@ -54,15 +54,15 @@
       {% else %}due now{% endif %}
     </td>
     <td class="td-actions" style="white-space:nowrap;">
-      <form method="post" action="/ansible/schedules/{{ s.id }}/run-now" style="display:inline;">
+      <form method="post" action="/ansible/schedules/{{ s.id }}/run-now" style="display:inline;">{{ csrf_field() }}
         <button class="btn btn-sm btn-ghost" type="submit">Run now</button>
       </form>
-      <form method="post" action="/ansible/schedules/{{ s.id }}/toggle" style="display:inline;">
+      <form method="post" action="/ansible/schedules/{{ s.id }}/toggle" style="display:inline;">{{ csrf_field() }}
         <button class="btn btn-sm btn-ghost" type="submit">{{ "Pause" if s.enabled else "Resume" }}</button>
       </form>
       <a href="?edit={{ s.id }}#form" class="btn btn-sm btn-ghost">Edit</a>
       <form method="post" action="/ansible/schedules/{{ s.id }}/delete" style="display:inline;"
-            onsubmit="return confirm('Delete schedule {{ s.name }}?');">
+            onsubmit="return confirm('Delete schedule {{ s.name }}?');">{{ csrf_field() }}
         <button class="btn btn-sm btn-danger" type="submit">Delete</button>
       </form>
     </td>
@@ -79,7 +79,7 @@
 {% set declared_names = (edit_variables or []) | map(attribute='name') | list %}
 <div class="card" id="form">
   <h2 class="section-title" style="margin-bottom:1rem;">{{ "Edit schedule" if editing else "New schedule" }}</h2>
-  <form method="post" action="{{ '/ansible/schedules/' ~ editing.id if editing else '/ansible/schedules' }}">
+  <form method="post" action="{{ '/ansible/schedules/' ~ editing.id if editing else '/ansible/schedules' }}">{{ csrf_field() }}
     <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:1rem;">
       <div class="form-group" style="margin-bottom:0;">
         <label>Name</label>