[rd-code-23]

What changed

• add GET /auth/me for anonymous and authenticated auth-state hydration
• add GET /auth/csrf-token backed by the server-side session
• add CSRF-protected, idempotent POST /auth/logout
• destroy the PostgreSQL session and clear the opaque session cookie on logout
• apply synchronizer-token CSRF protection globally to unsafe HTTP methods
• return only the current user’s public profile fields
• add the documented csrf-sync dependency

Why

The browser needs a minimal API for discovering its current authentication state, protecting cookie-authenticated mutations, and safely ending a session.

Security behavior

• CSRF tokens are stored in server-side session state and returned through a dedicated endpoint
• clients must return the token in X-CSRF-Token
• missing, invalid, and cross-session tokens return a safe 403 response
• logout revokes CSRF state, destroys the session, and clears the cookie
• provider identity fields, tokens, session contents, and secrets are not exposed

Validation

• pnpm --filter @goforlift/api lint
• pnpm --filter @goforlift/api typecheck
• pnpm --filter @goforlift/api test — 42 tests passed
• pnpm --filter @goforlift/api build
• manually verified auth hydration, CSRF rejection, valid logout, and anonymous state after logout

Closes #10