Feat/be w3a 112 csrf protection

[michaelvic123]

Changes

• Added CSRF middleware using double-submit cookie pattern
• Added /api/v1/auth/csrf endpoint to get CSRF token
• Updated frontend to automatically include CSRF token in state-changing requests
• Excluded auth challenge/verify routes from CSRF check
• Fixed TypeScript error for possible array CSRF header

closes #466

[vercel]

@michaelvic123 is attempting to deploy a commit to the mAzI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@michaelvic123 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits