security: add CSRF protection for state-mutating API routes

[smartalee]

Summary

Adds CSRF protection to all state-mutating API routes (POST, PATCH, DELETE) using the double-submit cookie pattern.

Changes

• Added src/lib/csrfMiddleware.ts with CSRF token generation and validation
• Updated src/middleware.ts to validate CSRF tokens on API requests
• Added CSRF validation to notes, bookmarks, approvals, and tips routes
• Auth endpoints and safe methods (GET/HEAD/OPTIONS) are exempt

Security

• Double-submit cookie pattern prevents CSRF attacks
• Timing-safe token comparison prevents timing attacks
• No server-side storage required (stateless)
• SameSite=Lax cookie strategy for additional protection

Testing

• CSRF validation prevents cross-origin state-mutating requests
• Valid tokens allow same-origin requests to succeed
• Auth endpoints remain accessible without CSRF validation

Closes #723

[drips-wave]

@smartalee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Great job so far

There are just two blockers — the workflow is failing and merge conflict. Could you take a look and fix it so all checks pass?

Happy to review again once that’s done.
You can pull from the main first before pushing. The workflow should pass