feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/dashboard/list.html

@@ -37,7 +37,7 @@
               <details style="position:relative;">
                 <summary class="btn btn-ghost btn-sm" style="cursor:pointer;list-style:none;">Rename</summary>
                 <div style="position:absolute;right:0;top:calc(100% + 4px);background:var(--bg-card);border:1px solid var(--border-mid);border-radius:6px;padding:0.75rem;z-index:50;width:220px;box-shadow:0 4px 16px rgba(0,0,0,0.4);">
-                  <form method="post" action="/dashboards/{{ dash.id }}/rename" style="display:flex;gap:0.4rem;">
+                  <form method="post" action="/dashboards/{{ dash.id }}/rename" style="display:flex;gap:0.4rem;">{{ csrf_field() }}
                     <input type="text" name="name" value="{{ dash.name }}"
                            style="flex:1;font-size:0.85rem;padding:0.3rem 0.5rem;" required>
                     <button type="submit" class="btn btn-sm">Save</button>
@@ -45,19 +45,19 @@
                 </div>
               </details>
 
-              <form method="post" action="/dashboards/{{ dash.id }}/toggle-share" style="margin:0;" title="{{ 'Make private' if dash.is_shared else 'Share with all users' }}">
+              <form method="post" action="/dashboards/{{ dash.id }}/toggle-share" style="margin:0;" title="{{ 'Make private' if dash.is_shared else 'Share with all users' }}">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">{{ '🔒' if dash.is_shared else '🔗' }}</button>
               </form>
 
               {% if not dash.is_default %}
-              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">
+              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">★</button>
               </form>
               {% endif %}
 
               {% if my_dashboards | length > 1 %}
               <form method="post" action="/dashboards/{{ dash.id }}/delete" style="margin:0;"
-                    onsubmit="return confirm('Delete \'{{ dash.name }}\'?')">
+                    onsubmit="return confirm('Delete \'{{ dash.name }}\'?')">{{ csrf_field() }}
                 <button type="submit" class="btn btn-danger btn-sm">Delete</button>
               </form>
               {% endif %}
@@ -94,7 +94,7 @@
             </div>
             <div style="display:flex;align-items:center;gap:0.4rem;flex-shrink:0;">
               <a href="/d/{{ dash.id }}" class="btn btn-ghost btn-sm">View</a>
-              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">
+              <form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
                 <button type="submit" class="btn btn-ghost btn-sm">★</button>
               </form>
               {# Admins can also edit system dashboards #}
@@ -115,7 +115,7 @@
   <div>
     <div class="section-title" style="margin-bottom:0.75rem;">New Dashboard</div>
     <div class="card" style="margin-bottom:0;">
-      <form method="post" action="/dashboards/create">
+      <form method="post" action="/dashboards/create">{{ csrf_field() }}
         <div class="form-group" style="margin-bottom:0.75rem;">
           <label>Name</label>
           <input type="text" name="name" placeholder="e.g. Network Overview" required>