feat(security): add CSRF protection for all state-changing API routes

- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated

lib/api-client-react/src/generated/api.schemas.ts

@@ -30,6 +30,10 @@ export interface AuthMode {
   mode: AuthModeMode;
 }
 
+export interface CsrfToken {
+  token: string;
+}
+
 export interface LocalLoginInput {
   username: string;
   password: string;