feat(security): add CSRF protection for all state-changing API routes

- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated

lib/api-zod/src/generated/api.ts

@@ -445,6 +445,14 @@ export const GetAuthModeResponse = zod.object({
 })
 
 
+/**
+ * @summary Get a CSRF token for state-changing requests
+ */
+export const GetCsrfTokenResponse = zod.object({
+  "token": zod.string()
+})
+
+
 /**
  * @summary Local username/password login
  */

lib/api-zod/src/generated/types/csrfToken.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.9.1 🍺
+ * Do not edit manually.
+ * Api
+ * ToolRate API — Tool listing and rating platform
+ * OpenAPI spec version: 0.1.0
+ */
+
+export interface CsrfToken {
+  token: string;
+}

lib/api-zod/src/generated/types/index.ts

@@ -15,6 +15,7 @@ export * from './authUserRole';
 export * from './authUserTier';
 export * from './categoryStats';
 export * from './changePasswordInput';
+export * from './csrfToken';
 export * from './emptyTrash200';
 export * from './errorResponse';
 export * from './getRatingDistributionParams';