feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/hosts/detail.html

@@ -16,7 +16,7 @@
     <a href="/hosts/{{ host.id }}/edit" class="btn btn-ghost btn-sm">Edit</a>
     {% if session.user_role == 'admin' %}
     <form method="post" action="/hosts/{{ host.id }}/delete" style="margin:0;"
-          onsubmit="return confirm('Delete host {{ host.name }}? Monitors and history are removed.');">
+          onsubmit="return confirm('Delete host {{ host.name }}? Monitors and history are removed.');">{{ csrf_field() }}
       <button type="submit" class="btn btn-danger btn-sm">Delete</button>
     </form>
     {% endif %}
@@ -78,7 +78,7 @@
     <div style="display:flex;gap:0.35rem;flex-shrink:0;">
       <a href="/monitors/{{ m.id }}/edit" class="btn btn-sm btn-ghost" style="padding:0.2rem 0.5rem;font-size:0.72rem;">Edit</a>
       <form method="post" action="/monitors/{{ m.id }}/delete" style="display:inline;"
-            onsubmit="return confirm('Delete monitor {{ m.name }}?');">
+            onsubmit="return confirm('Delete monitor {{ m.name }}?');">{{ csrf_field() }}
         <button type="submit" class="btn btn-sm" style="padding:0.2rem 0.5rem;font-size:0.72rem;color:var(--red);">✕</button>
       </form>
     </div>
@@ -94,7 +94,7 @@
   {% if session.user_role in ['operator', 'admin'] %}
   <details style="margin-top:0.75rem;">
     <summary style="cursor:pointer;font-size:0.85rem;color:var(--text-muted);">+ Add monitor for this host</summary>
-    <form method="post" action="/monitors/add" style="display:grid;gap:0.6rem;margin-top:0.75rem;">
+    <form method="post" action="/monitors/add" style="display:grid;gap:0.6rem;margin-top:0.75rem;">{{ csrf_field() }}
       <input type="hidden" name="host_id" value="{{ host.id }}">
       <div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:0.6rem;align-items:end;">
         <div>
@@ -148,7 +148,7 @@
       {% endif %}
     </div>
     <a href="/ansible/inventory/targets/{{ linked_target.id }}" class="btn btn-ghost btn-sm">Edit target</a>
-    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="margin:0;">
+    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="margin:0;">{{ csrf_field() }}
       <input type="hidden" name="action" value="unlink">
       <button type="submit" class="btn btn-ghost btn-sm">Unlink</button>
     </form>
@@ -157,7 +157,7 @@
   {% if ansible_sources %}
   <details>
     <summary style="cursor:pointer;font-size:0.85rem;color:var(--text-muted);">Run a playbook against this host</summary>
-    <form method="post" action="/hosts/{{ host.id }}/run-playbook" style="margin-top:0.75rem;">
+    <form method="post" action="/hosts/{{ host.id }}/run-playbook" style="margin-top:0.75rem;">{{ csrf_field() }}
       <div class="form-group">
         <label>Source</label>
         <select name="source_name" required
@@ -202,7 +202,7 @@
   </p>
   <div style="display:flex;gap:0.75rem;flex-wrap:wrap;align-items:flex-end;">
     {% if linkable_targets %}
-    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="display:flex;gap:0.5rem;align-items:center;">
+    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="display:flex;gap:0.5rem;align-items:center;">{{ csrf_field() }}
       <input type="hidden" name="action" value="link">
       <select name="target_id">
         {% for tgt in linkable_targets %}<option value="{{ tgt.id }}">{{ tgt.name }} ({{ tgt.address }})</option>{% endfor %}
@@ -210,7 +210,7 @@
       <button type="submit" class="btn btn-sm">Link</button>
     </form>
     {% endif %}
-    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="margin:0;">
+    <form method="post" action="/hosts/{{ host.id }}/ansible-link" style="margin:0;">{{ csrf_field() }}
       <input type="hidden" name="action" value="create">
       <button type="submit" class="btn btn-sm btn-ghost">Create target from this host</button>
     </form>

steward/templates/hosts/form.html

@@ -6,7 +6,7 @@
 <div style="max-width:560px;margin:2rem auto;">
     <h1 class="page-title">{% if host %}Edit Host{% else %}Add Host{% endif %}</h1>
     <div class="card">
-        <form method="post" action="{% if host %}/hosts/{{ host.id }}{% else %}/hosts/{% endif %}">
+        <form method="post" action="{% if host %}/hosts/{{ host.id }}{% else %}/hosts/{% endif %}">{{ csrf_field() }}
             <div class="form-group">
                 <label>Display Name</label>
                 <input type="text" name="name" value="{{ host.name if host else '' }}" required autofocus>

steward/templates/hosts/list.html

@@ -78,7 +78,7 @@
                 </td>
                 <td class="td-actions">
                     <a href="/hosts/{{ host.id }}/edit" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
-                    <form method="post" action="/hosts/{{ host.id }}/delete" style="display:inline;">
+                    <form method="post" action="/hosts/{{ host.id }}/delete" style="display:inline;">{{ csrf_field() }}
                         <button type="submit" class="btn btn-sm btn-danger"
                             onclick="return confirm('Delete {{ host.name }}?')">Delete</button>
                     </form>