feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_api_tokens.py

@@ -132,6 +132,8 @@ def test_routes_create_list_and_revoke(app):
             sess["user_id"] = uid
             sess["user_role"] = "operator"
             sess["username"] = "route-test"
+            sess["_csrf"] = "test-token"
+        csrf = {"X-CSRF-Token": "test-token"}
 
         resp = await client.get("/ai-access/")
         assert resp.status_code == 200
@@ -143,12 +145,12 @@ def test_routes_create_list_and_revoke(app):
         assert 'value="http://localhost/mcp"' in page and "claude mcp add" in page
 
         resp = await client.post("/ai-access/tokens", form={
-            "name": "laptop", "role": "admin", "expires_in_days": ""})
+            "name": "laptop", "role": "admin", "expires_in_days": ""}, headers=csrf)
         assert resp.status_code == 400
         assert "higher role" in await resp.get_data(as_text=True)
 
         resp = await client.post("/ai-access/tokens", form={
-            "name": "laptop", "role": "operator", "expires_in_days": "30"})
+            "name": "laptop", "role": "operator", "expires_in_days": "30"}, headers=csrf)
         assert resp.status_code == 200
         created = await resp.get_data(as_text=True)
         raw = re.search(r'value="(stw_[^"]+)"', created).group(1)
@@ -163,7 +165,7 @@ def test_routes_create_list_and_revoke(app):
         assert "laptop" in page and token.prefix in page
         assert raw not in page
 
-        resp = await client.post(f"/ai-access/tokens/{token.id}/revoke")
+        resp = await client.post(f"/ai-access/tokens/{token.id}/revoke", headers=csrf)
         assert resp.status_code == 302
         assert await api_tokens.resolve_token(app, raw) is None