v0.23.0 — CSRF protection on all browser-facing POST endpoints

Controller:
- internal/web/csrf.go (new): CsrfProtect middleware, csrfToken/csrfField helpers
- auth.go: per-session CSRF token (csrfToken field, csrfTokenForSession method)
- server.go: executeTemplate wrapper auto-injects CSRFField+CSRFToken
- main.go: wire CsrfProtect on all routes; bump to v0.23.0
- handlers.go, storage_handlers.go, handler_restore.go: executeTemplate
- All templates: CSRFField in forms, meta csrf-token, csrfHeaders() JS helper,
  fetch calls updated; sendBeacon→fetch+keepalive in storage_attach.html

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

controller/internal/web/templates/backups.html

@@ -580,7 +580,7 @@ function toggleTier(header) {
 function triggerCrossDriveBackup(stackName, btn) {
     btn.disabled = true;
     btn.textContent = 'Fut...';
-    fetch('/api/stacks/' + stackName + '/cross-backup/run', {method: 'POST'})
+    fetch('/api/stacks/' + stackName + '/cross-backup/run', {method: 'POST', headers: csrfHeaders()})
     .then(function(r) { return r.json(); })
     .then(function(d) {
         if (!d.ok) {
@@ -602,7 +602,7 @@ function triggerCrossDriveBackup(stackName, btn) {
 function triggerAllCrossDrive(btn) {
     btn.disabled = true;
     btn.textContent = 'Indítás...';
-    fetch('/api/backup/cross-drive/run-all', {method: 'POST'})
+    fetch('/api/backup/cross-drive/run-all', {method: 'POST', headers: csrfHeaders()})
     .then(function(r) { return r.json(); })
     .then(function(d) {
         if (!d.ok) {
@@ -625,7 +625,7 @@ function triggerBackupFromPage() {
     const btn = document.getElementById('backup-page-btn');
     btn.disabled = true;
     btn.textContent = 'Mentés indítása...';
-    fetch('/api/backup/run', { method: 'POST' })
+    fetch('/api/backup/run', { method: 'POST', headers: csrfHeaders() })
         .then(r => r.json())
         .then(data => {
             if (data.ok) {
@@ -782,6 +782,11 @@ function submitRestore() {
     form.method = 'POST';
     form.action = '/backup/restore';
 
+    var fc = document.createElement('input');
+    fc.type = 'hidden'; fc.name = '_csrf';
+    fc.value = (document.querySelector('meta[name="csrf-token"]') || {}).content || '';
+    form.appendChild(fc);
+
     var f1 = document.createElement('input');
     f1.type = 'hidden'; f1.name = 'stack_name'; f1.value = app;
     form.appendChild(f1);