feat: optional CSRF protection for cookie/session-based flows #53

Context

• CSRF matters for cookie-based sessions and HTML forms using session cookies. Pure JWT-in-Authorization APIs often skip CSRF; OxyRoute should offer an optional building block for mixed or server-rendered apps.
• See Feature gaps.

Direction

• Options: double-submit cookie, synchronizer token in form + server store, or integration notes with a session library.
• Safe defaults: constant-time compare, SameSite cookie guidance, reject missing token on mutating methods when enabled.

Acceptance criteria

• Document threat model (when CSRF applies / when it does not).
• Pytest for at least one pattern (e.g. token mismatch → 403).

Research

• Starlette CSRF middleware patterns; OWASP CSRF Prevention Cheat Sheet.