feat(security): add CSRF protection for all state-changing API routes

- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated

artifacts/api-server/src/routes/index.ts

@@ -8,9 +8,12 @@ import usersRouter from "./users";
 import auditRouter from "./audit";
 import costsRouter from "./costs";
 import adminRouter from "./admin";
+import { csrfProtection } from "../middleware/csrf";
 
 const router: IRouter = Router();
 
+router.use(csrfProtection);
+
 router.use(authRouter);
 router.use(healthRouter);
 router.use(toolsRouter);