Fix CSRF middleware planned before introducing any cookie-based auth

[ZionApprove]

Summary

Implemented a production-ready double-submit-cookie CSRF middleware guarded behind the CSRF_PROTECTION_ENABLED feature flag, while maintaining the existing security posture where CSRF is mitigated by design (API-key header auth).

Changes

• Created src/common/security/csrf.middleware.ts — double-submit-cookie CSRF middleware with:
  • Cookie parsing from Cookie header (no cookie-parser dependency)
  • Cryptographically random 32-byte tokens via crypto.randomBytes
  • Constant-time token comparison via crypto.timingSafeEqual
  • SameSite=strict, secure in production, 1-hour expiry
  • Only active when CSRF_PROTECTION_ENABLED=true
• Created src/common/security/csrf.middleware.spec.ts — 13 unit tests covering:
  • Safe methods receive CSRF cookie
  • Existing valid cookies not overwritten
  • Unsafe methods reject missing tokens (cookie/header)
  • Unsafe methods reject mismatched tokens
  • Unsafe methods accept matching tokens (POST, PUT, PATCH, DELETE)
  • Token length mismatch handling
• Created docs/security/csrf-posture.md — documentation covering:
  • Current CSRF posture and when it would break
  • Middleware contract and enabling instructions
  • Client integration guide with code examples
• Updated main.ts to conditionally register CSRF middleware
• Updated security.module.ts posture comment to reference the new middleware

Closes #217

[kilodesodiq-arch]

LGTM