feat: Add CSRF protection for gateway WebSocket

[rexlunae]

Summary

Adds CSRF token generation and validation for gateway control messages from @aecs4u (PR #21).

Security Purpose

Prevents cross-site WebSocket hijacking attacks where a malicious webpage could:

• Send control commands to a locally-running gateway
• Reload configuration with malicious settings
• Enable elevated mode without user consent

Implementation

CsrfStore (src/gateway/csrf.rs)

• Issues 32-byte cryptographically random tokens
• URL-safe base64 encoding
• Configurable TTL (default: 1 hour)
• Automatic pruning of expired tokens

Flow

1. Gateway issues CSRF token in hello frame
2. TUI/CLI stores token from hello response
3. Control messages include token
4. Gateway validates before processing

Usage

use rustyclaw::gateway::csrf::CsrfStore;

let mut store = CsrfStore::default();
let token = store.issue_token();

// Later, validate incoming token
if !store.validate(&incoming_token) {
    return Err("Invalid CSRF token");
}

Tests

• Token is 32 cryptographically random bytes
• Fresh tokens validate successfully
• Expired tokens are rejected

Dependencies

• rand = "0.9" — Cryptographic RNG

Attribution

Original implementation by @aecs4u