feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/dashboard/_widget_drawer.html

@@ -27,7 +27,7 @@
         </summary>
         <form action="/d/{{ dashboard.id }}/edit/add/{{ w.key }}" method="post"
               class="add-widget-form"
-              style="padding:0.75rem 0.85rem;padding-top:0;border-top:1px solid var(--border);">
+              style="padding:0.75rem 0.85rem;padding-top:0;border-top:1px solid var(--border);">{{ csrf_field() }}
           <div style="display:grid;gap:0.5rem;padding-top:0.75rem;">
             <div>
               <label style="font-size:0.74rem;color:var(--text-muted);display:block;margin-bottom:0.2rem;">

steward/templates/dashboard/index.html

@@ -73,13 +73,14 @@
   }, gridEl);
 
   if (!canEdit) return;                         // viewers get the static grid only
+  var csrf = document.querySelector('meta[name="csrf-token"]').content;
 
   function saveLayout() {
     var items = grid.save(false).map(function (n) {
       return { id: parseInt(n.id, 10), x: n.x, y: n.y, w: n.w, h: n.h };
     });
     fetch('/d/' + dashId + '/edit/layout', {
-      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
       body: JSON.stringify({ items: items }),
     });
   }
@@ -101,7 +102,7 @@
   document.querySelectorAll('.add-widget-form').forEach(function (form) {
     form.addEventListener('submit', function (ev) {
       ev.preventDefault();
-      fetch(form.action, { method: 'POST', body: new FormData(form) })
+      fetch(form.action, { method: 'POST', body: new FormData(form), headers: { 'X-CSRF-Token': csrf } })
         .then(function (r) { return r.status === 204 ? '' : r.text(); })
         .then(function (html) {
           if (!html) return;
@@ -126,7 +127,8 @@
     if (!rm) return;
     ev.preventDefault();
     var item = rm.closest('.grid-stack-item');
-    fetch('/d/' + dashId + '/edit/remove/' + rm.dataset.remove, { method: 'POST' })
+    fetch('/d/' + dashId + '/edit/remove/' + rm.dataset.remove,
+          { method: 'POST', headers: { 'X-CSRF-Token': csrf } })
       .then(function () { if (item) grid.removeWidget(item); });
   });
 

steward/templates/dashboard/list.html

@@ -37,7 +37,7 @@
               <details style="position:relative;">
                 <summary class="btn btn-ghost btn-sm" style="cursor:pointer;list-style:none;">Rename</summary>
                 <div style="position:absolute;right:0;top:calc(100% + 4px);background:var(--bg-card);border:1px solid var(--border-mid);border-radius:6px;padding:0.75rem;z-index:50;width:220px;box-shadow:0 4px 16px rgba(0,0,0,0.4);">
-                  <form method="post" action="/dashboards/{{ dash.id }}/rename" style="display:flex;gap:0.4rem;">
+                  <form method="post" action="/dashboards/{{ dash.id }}/rename" style="display:flex;gap:0.4rem;">{{ csrf_field() }}
                     <input type="text" name="name" value="{{ dash.name }}"
                            style="flex:1;font-size:0.85rem;padding:0.3rem 0.5rem;" required>
                     <button type="submit" class="btn btn-sm">Save</button>
@@ -45,19 +45,19 @@
                 </div>
               </details>
 
-              <form method="post" action="/dashboards/{{ dash.id }}/toggle-share" style="margin:0;" title="{{ 'Make private' if dash.is_shared else 'Share with all users' }}">
+              <form method="post" action="/dashboards/{{ dash.id }}/toggle-share" style="margin:0;" title="{{ 'Make private' if dash.is_shared else 'Share with all users' }}">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">{{ '🔒' if dash.is_shared else '🔗' }}</button>
               </form>
 
               {% if not dash.is_default %}
-              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">
+              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">★</button>
               </form>
               {% endif %}
 
               {% if my_dashboards | length > 1 %}
               <form method="post" action="/dashboards/{{ dash.id }}/delete" style="margin:0;"
-                    onsubmit="return confirm('Delete \'{{ dash.name }}\'?')">
+                    onsubmit="return confirm('Delete \'{{ dash.name }}\'?')">{{ csrf_field() }}
                 <button type="submit" class="btn btn-danger btn-sm">Delete</button>
               </form>
               {% endif %}
@@ -94,7 +94,7 @@
             </div>
             <div style="display:flex;align-items:center;gap:0.4rem;flex-shrink:0;">
               <a href="/d/{{ dash.id }}" class="btn btn-ghost btn-sm">View</a>
-              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">
+              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">★</button>
               </form>
               {# Admins can also edit system dashboards #}
@@ -115,7 +115,7 @@
   <div>
     <div class="section-title" style="margin-bottom:0.75rem;">New Dashboard</div>
     <div class="card" style="margin-bottom:0;">
-      <form method="post" action="/dashboards/create">
+      <form method="post" action="/dashboards/create">{{ csrf_field() }}
         <div class="form-group" style="margin-bottom:0.75rem;">
           <label>Name</label>
           <input type="text" name="name" placeholder="e.g. Network Overview" required>

steward/templates/dashboard/share.html

@@ -32,7 +32,7 @@
             </div>
           </div>
           <form method="post" action="/d/{{ dashboard.id }}/share/revoke/{{ token.id }}"
-                style="margin:0;" onsubmit="return confirm('Revoke this share link?')">
+                style="margin:0;" onsubmit="return confirm('Revoke this share link?')">{{ csrf_field() }}
             <button type="submit" class="btn btn-danger btn-sm">Revoke</button>
           </form>
         </div>
@@ -50,7 +50,7 @@
   <div>
     <div class="section-title" style="margin-bottom:0.75rem;">Create Share Link</div>
     <div class="card" style="margin-bottom:0;">
-      <form method="post" action="/d/{{ dashboard.id }}/share/create">
+      <form method="post" action="/d/{{ dashboard.id }}/share/create">{{ csrf_field() }}
         <div class="form-group" style="margin-bottom:0.75rem;">
           <label>Label <span style="color:var(--text-muted);font-size:0.78rem;">(optional)</span></label>
           <input type="text" name="label" placeholder="e.g. Public display screen">