[SECURITY] Add CSRF Protection

[JoshuaAFerguson]

Objective

Implement CSRF protection for state-changing requests.

Implementation

import "github.com/utrack/gin-csrf"

router.Use(csrf.Middleware(csrf.Options{
    Secret: "secret-key",
    ErrorFunc: func(c *gin.Context) {
        c.AbortWithStatus(403)
    },
}))

Acceptance Criteria

• CSRF tokens required for POST/PUT/DELETE
• Tokens in cookies or headers
• UI updated to send tokens
• Tests pass

Files

• api/internal/middleware/csrf.go (NEW)
• ui/src/api/client.ts (update)

[JoshuaAFerguson]

Closing — CSRF middleware is implemented at api/internal/middleware/csrf.go with tests in csrf_test.go. Wired into the router for state-changing endpoints.