feat(web): roll out checkSameOrigin CSRF guard to all cookie-auth mutation routes

[iaj6]

What

Extends the same-origin CSRF guard — previously only on change-password and device/approve — to every remaining cookie-authenticated, state-changing API route. checkSameOrigin(req) runs as the first statement in each handler (before auth, body parsing, rate limiting, DB access, or any side effect), so a cross-origin request is rejected with 403 before any work happens. Defense-in-depth on top of the SameSite=Lax session cookie.

Guarded handlers (17 new)

auth/login, auth/logout, policies POST, policies/[id] PATCH/PUT/DELETE, policies/load-starters POST, webhooks POST, webhooks/[id] PATCH/DELETE, webhooks/[id]/test POST, tokens/[id] DELETE, users POST, budgets/[userId] PUT/DELETE, runs/[id]/decide POST, sessions/[id] PATCH.

login is included so a forged cross-origin sign-in (login-CSRF / session fixation) is rejected before the rate-limiter or scrypt hash runs.

Deliberately NOT guarded (rationale)

Route	Why excluded
runs/search POST	Read-only (returns repos/branches filter options, writes nothing) → no CSRF risk. Documented inline.
/api/sdk/*	Bearer-only — cookies can't authenticate them, so not CSRF-able.
auth/device, auth/device/token	Pre-auth device-grant endpoints; never read the session cookie.

Tests

New csrf-guard.test.ts — 57 cases (19 cookie-auth mutation routes × {cross-origin → 403, same-origin → passes guard, Origin-less → passes guard}). Covers the two pre-existing guards too, making this file the authoritative cross-origin-rejection regression gate.

Verification

• ✅ web lint 0/0, npm run build green, 1223 tests pass
• ✅ Adversarial 3-lens review (completeness / ordering / scope): 0 real problems — no missing cookie-auth mutation route, guard is the first statement everywhere (confirmed before login's rate-limiter and before the webhook test-dispatch), runs/search exclusion and login inclusion both validated.

Independent of #8 (different files; no overlap).

🤖 Generated with Claude Code