feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/monitors/edit.html

@@ -12,7 +12,7 @@
 {% set lbl = "font-size:0.75rem;color:var(--text-muted);display:block;margin-bottom:0.2rem;" %}
 
 <div class="card" style="max-width:760px;">
-  <form method="post" action="/monitors/{{ monitor.id }}/edit" style="display:grid;gap:0.6rem;">
+  <form method="post" action="/monitors/{{ monitor.id }}/edit" style="display:grid;gap:0.6rem;">{{ csrf_field() }}
     <div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(160px,1fr));gap:0.6rem;align-items:end;">
       <div>
         <label style="{{ lbl }}">Type</label>

steward/templates/monitors/index.html

@@ -16,7 +16,7 @@
 {# ── Add monitor ──────────────────────────────────────────────────────────── #}
 <div class="card" style="margin-bottom:1.25rem;">
   <div class="section-title" style="margin-bottom:0.75rem;">Add Monitor</div>
-  <form method="post" action="/monitors/add" style="display:grid;gap:0.6rem;">
+  <form method="post" action="/monitors/add" style="display:grid;gap:0.6rem;">{{ csrf_field() }}
     <div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(160px,1fr));gap:0.6rem;align-items:end;">
       <div>
         <label style="{{ lbl }}">Type</label>

steward/templates/monitors/rows.html

@@ -54,12 +54,12 @@
   {% if session.user_role in ['operator', 'admin'] %}
   <div style="display:flex;gap:0.35rem;flex-shrink:0;">
     <a href="/monitors/{{ m.id }}/edit" class="btn btn-sm" style="padding:0.2rem 0.5rem;font-size:0.72rem;">Edit</a>
-    <form method="post" action="/monitors/{{ m.id }}/toggle" style="display:inline;">
+    <form method="post" action="/monitors/{{ m.id }}/toggle" style="display:inline;">{{ csrf_field() }}
       <button type="submit" class="btn btn-sm" style="padding:0.2rem 0.5rem;font-size:0.72rem;">
         {{ "Pause" if m.enabled else "Resume" }}</button>
     </form>
     <form method="post" action="/monitors/{{ m.id }}/delete" style="display:inline;"
-          onsubmit="return confirm('Delete monitor {{ m.name }}?');">
+          onsubmit="return confirm('Delete monitor {{ m.name }}?');">{{ csrf_field() }}
       <button type="submit" class="btn btn-sm" style="padding:0.2rem 0.5rem;font-size:0.72rem;color:var(--red);">✕</button>
     </form>
   </div>