feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/dashboard/index.html

@@ -73,13 +73,14 @@
   }, gridEl);
 
   if (!canEdit) return;                         // viewers get the static grid only
+  var csrf = document.querySelector('meta[name="csrf-token"]').content;
 
   function saveLayout() {
     var items = grid.save(false).map(function (n) {
       return { id: parseInt(n.id, 10), x: n.x, y: n.y, w: n.w, h: n.h };
     });
     fetch('/d/' + dashId + '/edit/layout', {
-      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
       body: JSON.stringify({ items: items }),
     });
   }
@@ -101,7 +102,7 @@
   document.querySelectorAll('.add-widget-form').forEach(function (form) {
     form.addEventListener('submit', function (ev) {
       ev.preventDefault();
-      fetch(form.action, { method: 'POST', body: new FormData(form) })
+      fetch(form.action, { method: 'POST', body: new FormData(form), headers: { 'X-CSRF-Token': csrf } })
         .then(function (r) { return r.status === 204 ? '' : r.text(); })
         .then(function (html) {
           if (!html) return;
@@ -126,7 +127,8 @@
     if (!rm) return;
     ev.preventDefault();
     var item = rm.closest('.grid-stack-item');
-    fetch('/d/' + dashId + '/edit/remove/' + rm.dataset.remove, { method: 'POST' })
+    fetch('/d/' + dashId + '/edit/remove/' + rm.dataset.remove,
+          { method: 'POST', headers: { 'X-CSRF-Token': csrf } })
       .then(function () { if (item) grid.removeWidget(item); });
   });