feat(auth): forged browser requests are refused (#5031)

#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_auth.py

@@ -15,6 +15,13 @@ def make_user(role=UserRole.admin):
     )
 
 
+async def with_csrf(client) -> dict:
+    """Seed the session's forged-request token; returns the header to send."""
+    async with client.session_transaction() as sess:
+        sess["_csrf"] = "test-token"
+    return {"X-CSRF-Token": "test-token"}
+
+
 @pytest.mark.asyncio
 async def test_login_page_returns_200(client):
     response = await client.get("/login")
@@ -32,9 +39,11 @@ async def test_login_redirects_to_setup_when_no_users(client, app):
 @pytest.mark.asyncio
 async def test_login_success_redirects_to_dashboard(client, app):
     user = make_user()
+    headers = await with_csrf(client)
     with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
          patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
-        response = await client.post("/login", form={"username": "admin", "password": "password"})
+        response = await client.post("/login", form={"username": "admin", "password": "password"},
+                                     headers=headers)
     assert response.status_code == 302
     assert "/" in response.headers["Location"]
 
@@ -42,9 +51,11 @@ async def test_login_success_redirects_to_dashboard(client, app):
 @pytest.mark.asyncio
 async def test_login_failure_returns_400(client, app):
     user = make_user()
+    headers = await with_csrf(client)
     with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
          patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
-        response = await client.post("/login", form={"username": "admin", "password": "wrong"})
+        response = await client.post("/login", form={"username": "admin", "password": "wrong"},
+                                     headers=headers)
     assert response.status_code == 400