fix(security): add CSRF protection and complete all 10 security fixes

[laolusrael]

Summary

Completes all 10 security fixes identified in the security audit:

Fix #10 (This PR): CSRF Protection

• New CSRF middleware with server-side token store (csrf.go)
  • Generates per-session CSRF tokens (crypto/rand based64)
  • Stores tokens in memory with 24h TTL + automatic cleanup
  • Validates X-CSRF-Token header on all mutating requests (POST/PUT/DELETE)
  • Sets cloudpass_session cookie for session identification
  • Safe methods (GET/HEAD/OPTIONS) auto-generate fresh tokens
• Wire up CSRF in main.go with /api/csrf/token endpoint
• Add X-CSRF-Token header to CORS AllowHeaders
• Update frontend api.ts to fetch and inject CSRF tokens
  • Fetches CSRF token on initCSRF() call
  • Injects X-CSRF-Token header on all POST/PUT/DELETE/PATCH requests
  • Uses credentials include for cookie support

Other Fixes Included (from develop branch)

1. Fix feat: initial project setup #1: IP whitelist proxy header support (X-Forwarded-For, X-Real-IP)
2. Fix fix: improve instance details page #2: Rate limiter memory leak (cleanup goroutine, max entries, Stop())
3. Fix feat: add image dropdown with filter to create instance form #3: CORS configuration (CORSAllowedOrigins config option)
4. Fix feat: implement Phase 2 advanced lifecycle features #4: WebSocket authentication (covered by Fix feat: initial project setup #1)
5. Fix feat: implement Phase 3 advanced features #5: Config information disclosure (removed AllowedIPs/SSHKeyPath from GET /config)
6. Fix feat: implement Phase 3 advanced features #6: Health endpoint moved outside API group (public route)
7. Fix feat(logging): add structured logging to handlers and multipass client #7: Config update validation (CIDR, port, log level checks)
8. Fix feat: add mount management, settings page, and missing components #8: CIDR caching in IP whitelist (hot-reload via version tracking)
9. Fix fix: correct embedded assets and content-type for static files #9: Logging middleware (fallback status code, proper latency)

Testing

• All Go tests pass
• Go build succeeds
• CSRF flow: GET sets session cookie + token, POST validates token header

Threat Model Note

CSRF protection is defense-in-depth for this setup. CloudPass uses IP whitelisting (no sessions/cookies for auth). The CSRF token is per-session and validated server-side.