CSRF protection (Middlewares — P2)

  - **What:** Token‑based CSRF middleware with cookie/header token strategies and session integration hooks.
  - **Why Middlewares:** Policy‑heavy, interacts with session/cookie design.
  - **Precedents:** Echo CSRF; Fiber CSRF; Gin CSRF packages. (<https://echo.labstack.com/docs/middleware/csrf>, <https://docs.gofiber.io/api/middleware/csrf/>, <https://github.com/utrack/gin-csrf>)
