feat: render CSRF token into state-changing forms

Adds the csrf_token hidden field to every POST form in the web UI
(logout, bulk, purge-closed, close, reopen, analyze, reset,
delete-recording). Login stays without a token — SameSite=Strict
already blocks the relevant attack shapes and forced-login CSRF
has no impact here.

Shape:
- New askama macro partials/csrf_field.html renders the hidden
  input; 3 templates import + {% call csrf::field(csrf_token) %}
  inside each <form method="POST">.
- AuthenticatedWebUser carries csrf_token (cloned out of the
  session once during extraction) so render handlers don't need a
  second store lookup.
- 3 template structs (MyCasesTemplate, CasePageTemplate,
  CaseRecordingsTemplate) gain the field; render sites pass
  user.csrf_token through.

Safety-net tests:
- Each rendered page must contain the exact session csrf_token in
  a hidden input — catches anyone adding a new form without the
  macro.
- Happy-path round-trip: fetch page, parse token from HTML, POST
  with token → 303. Catches drift between rendered and accepted
  token formats.

server/src/auth.rs

@@ -78,6 +78,11 @@ pub struct AuthenticatedWebUser {
     /// Mirrors [`AuthenticatedUser::window_hours`] so the same policy
     /// is available to web handlers without a second config lookup.
     pub window_hours: u32,
+    /// Session's CSRF token. Rendered into every state-changing form
+    /// as a hidden field so the `CsrfForm` extractor can validate it
+    /// on the matching POST. Cloned out of the session record here so
+    /// the template handlers don't need a second store lookup.
+    pub csrf_token: String,
 }
 
 impl AuthenticatedWebUser {
@@ -146,6 +151,7 @@ where
             role: session.role.clone(),
             data_dir,
             window_hours,
+            csrf_token: session.csrf_token.clone(),
         })
     }
 }