feat: server-side CSRF token validation

Introduces CsrfForm<T>: a FromRequest extractor that looks up the
session's csrf_token and constant-time-compares it to a csrf_token
field in the form body. Drop-in replacement for Form<T> on every
state-changing /web/ POST handler. Missing or expired session →
redirect to /web/login; malformed body → 400; token mismatch → 403.

WebSession carries csrf_token, minted alongside the session token at
login and magic-link consume. Not rotated per request — rotation
would break multi-tab use and buys little over SameSite=Strict
cookies.

Handlers: bulk, purge-closed, reset, close, reopen, analyze,
delete-recording, logout all now require CsrfForm<_>. Login stays
unprotected (SameSite=Strict alone is sufficient — forced-login CSRF
has no impact on this codebase). /api/... is header-auth, exempt.

Constant-time compare via subtle::ConstantTimeEq avoids timing
oracles on the token.

Template work is NOT in this commit — browser forms still post
without csrf_token, so the live web UI will 403 until Schritt 6
(templates render the hidden field).

Tests: all 12 red specs in csrf_attack_test.rs now green, #[ignore]
removed. Integration tests that POSTed to protected endpoints
switched to a new create_router_and_session_store entrypoint which
returns a handle to the store so tests can read csrf_token for the
active session.

server/src/web_session.rs

@@ -11,6 +11,11 @@ pub struct WebSession {
     pub slug: String,
     pub role: String,
     pub expires_at: Instant,
+    /// CSRF token — bound to the session for its full lifetime. Minted
+    /// alongside the session cookie via [`generate_token`] and validated
+    /// by the `CsrfForm` extractor on every state-changing POST under
+    /// `/web/`. Not rotated per request (would break multi-tab use).
+    pub csrf_token: String,
 }
 
 pub type SessionStore = Arc<RwLock<HashMap<String, WebSession>>>;