v0.23.0 — CSRF protection on all browser-facing POST endpoints

Controller:
- internal/web/csrf.go (new): CsrfProtect middleware, csrfToken/csrfField helpers
- auth.go: per-session CSRF token (csrfToken field, csrfTokenForSession method)
- server.go: executeTemplate wrapper auto-injects CSRFField+CSRFToken
- main.go: wire CsrfProtect on all routes; bump to v0.23.0
- handlers.go, storage_handlers.go, handler_restore.go: executeTemplate
- All templates: CSRFField in forms, meta csrf-token, csrfHeaders() JS helper,
  fetch calls updated; sendBeacon→fetch+keepalive in storage_attach.html

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

controller/internal/web/templates/deploy.html

@@ -118,6 +118,7 @@
         </div>
         {{else}}
         <form method="post" action="/settings/cross-backup/{{.Meta.Slug}}">
+            {{.CSRFField}}
             <div class="settings-grid" style="margin-bottom:1rem">
                 <div class="settings-row">
                     <span class="settings-label">Engedélyezve</span>
@@ -375,7 +376,7 @@ function onScheduleChange() {
 function triggerCrossDriveBackup(stackName, btn) {
     btn.disabled = true;
     btn.textContent = 'Mentés folyamatban...';
-    fetch('/api/stacks/' + stackName + '/cross-backup/run', {method: 'POST'})
+    fetch('/api/stacks/' + stackName + '/cross-backup/run', {method: 'POST', headers: csrfHeaders()})
     .then(function(r) { return r.json(); })
     .then(function(d) {
         if (!d.ok) {
@@ -456,7 +457,7 @@ function deleteStaleData(stackName, stalePath, btn) {
 
     fetch('/api/storage/stale-cleanup', {
         method: 'POST',
-        headers: {'Content-Type': 'application/json'},
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
         body: JSON.stringify({stack_name: stackName, stale_path: stalePath})
     })
     .then(function(r) { return r.json(); })
@@ -553,7 +554,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
     try {
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
-            headers: {'Content-Type': 'application/json'},
+            headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
             body: JSON.stringify({values: values})
         });
         var data = await resp.json();