feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/ansible.html

@@ -39,11 +39,11 @@
       <span style="color:var(--text-muted);font-size:0.78rem;">Click to select — add to a host's <code>authorized_keys</code> to authorize Steward manually.</span>
     </div>
     <form method="post" action="/settings/ansible/generate-key"
-          onsubmit="return confirm('Regenerate the managed key? Already-provisioned hosts will reject Steward until you re-provision them.');">
+          onsubmit="return confirm('Regenerate the managed key? Already-provisioned hosts will reject Steward until you re-provision them.');">{{ csrf_field() }}
       <button type="submit" class="btn btn-ghost btn-sm">Regenerate key</button>
     </form>
     {% else %}
-    <form method="post" action="/settings/ansible/generate-key">
+    <form method="post" action="/settings/ansible/generate-key">{{ csrf_field() }}
       <button type="submit" class="btn">Generate managed key</button>
       <span style="color:var(--text-muted);font-size:0.78rem;margin-left:0.5rem;">ed25519 — created server-side, nothing to paste.</span>
     </form>
@@ -56,7 +56,7 @@
       Used by every playbook run (manual and alert-triggered). Stored on the server and
       never shown again after saving — leave a field blank to keep the current value.
     </p>
-    <form method="post" action="/settings/ansible/credentials">
+    <form method="post" action="/settings/ansible/credentials">{{ csrf_field() }}
       <div class="form-group">
         <label>SSH private key {{ (cfg_badge if ssh_key_set else not_set_badge) | safe }}</label>
         <textarea name="ssh_private_key" rows="4"