hub v0.3.8 — CSRF protection + secure session model

- server.go: replace literal hub_session=authenticated with random 64-char hex
  session tokens stored server-side (hubSession map + sync.RWMutex); per-session
  CSRF tokens; CleanupSessions goroutine; SameSite=Lax+Secure cookie; CSRF
  validation in ServeHTTP; csrfToken/csrfField helpers
- configs.go: add html/template import; pass CSRFField/CSRFToken to all template
  renders; renderConfigForm gains r *http.Request parameter
- config_form.html: {{.CSRFField}} in form
- customer_unified.html: meta csrf-token + csrfHeaders() JS; {{.CSRFField}} in
  all 5 POST forms; csrfHeaders() on 3 fetch calls
- main.go: start CleanupSessions goroutine

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hub/cmd/hub/main.go

@@ -192,6 +192,9 @@ func main() {
 	}
 	webServer.SetVersionChecker(versionChecker)
 
+	// Session cleanup — removes expired sessions every hour
+	go webServer.CleanupSessions(ctx)
+
 	// Prune on startup, then daily at configured time (default 04:30)
 	if cfg.Retention.MaxDays > 0 {
 		pruneAll(dataStore, cfg.Retention.MaxDays, logger)