…ode (#787 stage 1)

PR1 of the two-PR rollout for RFC #787. Adds the middleware, the SPA
wiring, and the AST-walking write-boundary registry, but does not yet
enforce — every gated request still passes through. Stage 2 (separate
PR) flips ``app.state.csrf_enforce`` to ``True`` plus a
``MEMTOMEM_WEB__CSRF_ENFORCE`` env rollback toggle and updates
SECURITY.md.

Why now: the local Web UI has a ``CORS allow-origin`` policy but no
write boundary against browser-origin attackers. Drive-by tabs,
DNS rebinding, and ``--host 0.0.0.0`` misconfigs all reach the
unsafe-method handlers today. Per the decision summary on #787:
A (token + Origin/Referer) over B-only, Host-header guard included
to defend rebinding, ``GET /api/session`` token transport, method-based
endpoint scope on ``/api/**``, and a shared write-boundary registry that
also locks down ``privacy.enforce_write_guard`` callsite coverage.

Server side
-----------
* ``web/middleware/csrf.py`` — ``CSRFGuardMiddleware`` checks
  ``X-Memtomem-CSRF`` header against ``app.state.csrf_token``,
  ``Origin`` / ``Referer`` against the loopback + operator-trusted
  origin allow-list, and ``Host`` against the loopback +
  operator-trusted host allow-list. Emits one structured
  ``web.csrf.observe`` log per gated request with the four decision
  flags. Stage 1 always passes through; ``app.state.csrf_enforce`` is
  the toggle PR2 will flip.
* ``web/app.py`` — generates the per-process token at ``create_app``,
  initializes empty allow-lists + ``csrf_enforce=False``, wires the
  middleware *inside* ``SecurityHeadersMiddleware`` so the eventual 403
  picks up nosniff / frame-options / CSP on its way out.
* ``web/routes/system.py`` — adds ``GET /api/session`` returning
  ``{csrf, mode}`` for SPA bootstrap. Not localhost-guarded at the
  route layer; the middleware covers Origin/Host for it uniformly.

CLI
---
* ``mm web`` gains ``--allow-remote-ui`` (acknowledgment flag for
  non-loopback binds), ``--trusted-origin HOST`` and
  ``--trusted-host HOST`` (repeatable allow-list entries that populate
  ``app.state.csrf_trusted_{origins,hosts}``). ``--host`` non-loopback
  without ``--allow-remote-ui`` emits a yellow warning explaining that
  PR2 will refuse to start in that combination.

SPA
---
* ``static/app.js`` — ``api(...)`` helper bootstraps the token from
  ``GET /api/session`` once, caches it, and threads
  ``X-Memtomem-CSRF`` on every unsafe method.
* 10 direct ``fetch()`` callsites that bypass ``api(...)`` are
  cleaned up to call ``ensureCsrfToken()`` and attach the header
  themselves: 2 in ``app.js`` (uploads), 5 in ``context-gateway.js``,
  1 in ``settings-hooks-watchdog.js``, 1 in ``settings-maintenance.js``.
* Cache-bust per ``feedback_static_asset_cache_bust.md``: app.js v100→v101,
  context-gateway.js v12→v13, settings-maintenance.js v1→v2,
  settings-hooks-watchdog.js v2→v3.

Tests
-----
* ``tests/test_web_csrf_middleware.py`` — 12 ``TestClient`` cases
  covering safe-method short-circuit, every negative-token case,
  loopback-Host pass, attacker-origin block, DELETE coverage,
  ``/api/session`` bootstrap exemption (exact path, not prefix),
  enforce-mode 403 wiring (so PR2 is a default flip), trusted-host
  allow-list, and non-``/api/*`` pass-through.
* ``tests/test_web_invariants_registry.py`` — AST-walking write-boundary
  registry per ``feedback_ast_architectural_guard_pattern.md``. Pins
  classification for every ``@router.{post,patch,put,delete}`` handler
  under ``web/routes/`` into ``_CSRF_PROTECTED`` / ``_CSRF_EXEMPT`` and
  separately into ``_REDACTION_PROTECTED`` / ``_REDACTION_EXEMPT``. The
  redaction side asserts each ``_REDACTION_PROTECTED`` handler actually
  calls ``privacy.enforce_write_guard``. Adding a new unsafe handler
  without classifying it fails noisily.
* ``tests-js/csrf-token-bootstrap.test.mjs`` — 4 vitest pins on the
  ``api()`` helper: GET sends no header and skips ``/api/session``,
  POST bootstraps once and caches across subsequent unsafe methods,
  and ``/api/session`` failure degrades gracefully without attaching
  an empty header.

Out of scope (PR2)
------------------
* Flip ``csrf_enforce`` default + add ``MEMTOMEM_WEB__CSRF_ENFORCE``
  rollback toggle.
* Refuse to start when ``--host`` is non-loopback without
  ``--allow-remote-ui``.
* SECURITY.md threat model documentation.

Co-Authored-By: Claude <[email protected]>