feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/plugins.html

@@ -55,7 +55,7 @@
   <form method="post" action="/settings/plugins/restart/"
         hx-post="/settings/plugins/restart/" hx-target="#restart-banner" hx-swap="outerHTML"
         onsubmit="return confirm('Restart the app now? This will briefly interrupt all monitoring.')"
-        style="margin:0;">
+        style="margin:0;">{{ csrf_field() }}
     <button type="submit" class="btn btn-ghost btn-sm" style="font-size:0.78rem;">Restart App</button>
   </form>
 </div>
@@ -135,7 +135,7 @@
       {% if orphan.removable %}
       <form method="post" action="/settings/plugins/orphans/{{ orphan.name }}/remove/"
             onsubmit="return confirm('Remove stored settings for &quot;{{ orphan.name }}&quot;? Its saved configuration, including any credentials, will be discarded. This cannot be undone.');"
-            style="margin:0;flex-shrink:0;">
+            style="margin:0;flex-shrink:0;">{{ csrf_field() }}
         <button type="submit" class="btn btn-danger btn-sm" style="font-size:0.78rem;">Remove</button>
       </form>
       {% endif %}