feat: add csrf

apps/api/swagger.json

@@ -47,6 +47,34 @@
     }
   },
   "paths": {
+    "/csrf/token": {
+      "get": {
+        "summary": "Issue CSRF token (sets cookie, returns token for X-CSRF-Token header)",
+        "tags": ["System"],
+        "responses": {
+          "200": {
+            "description": "CSRF token issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": { "type": "boolean", "example": true },
+                    "data": {
+                      "type": "object",
+                      "properties": {
+                        "token": { "type": "string" },
+                        "header_name": { "type": "string", "example": "X-CSRF-Token" }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/health": {
       "get": {
         "summary": "Health check",