fix: CSRF protection for email auth form endpoints

[Copilot]

Session cookie was set to SameSite=None in production, leaving the email login and registration POST endpoints open to CSRF/login-CSRF attacks from cross-origin form submissions.

Changes

• hono/app.tsx
  • Hardened session cookie from SameSite=None (production) → SameSite=Lax unconditionally. Blocks cross-site form POSTs at the browser layer while preserving Google OAuth redirect flows (top-level GET navigations are unaffected by Lax).
  • Added Hono's built-in csrf() middleware as a second layer — rejects non-safe form submissions where the Origin header doesn't match the server origin. Placed after static file routes to avoid unnecessary overhead on asset requests.

// Before
sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",

// After
sameSite: "lax",

app.use("/static/*", serveStatic({ root: "./hono" }));
app.use("*", csrf()); // origin-check on form POSTs

• hono/routes/emailAuth.test.ts
  • Added Origin: "http://localhost" to all existing POST test requests to satisfy the CSRF middleware in the test environment.
  • Added tests asserting cross-origin form submissions to both /auth/login and /auth/register receive 403 Forbidden.

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.