feat(frontend): T46 configure HTMX and CSRF protection

- Add CSRFMiddleware for form protection
- Implement token generation and validation
- Add CSRF meta tag to base.html
- Create tests for CSRF protection

Tests: 13 passing

src/openrouter_monitor/main.py

@@ -11,6 +11,7 @@ from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 
 from openrouter_monitor.config import get_settings
+from openrouter_monitor.middleware.csrf import CSRFMiddleware
 from openrouter_monitor.routers import api_keys
 from openrouter_monitor.routers import auth
 from openrouter_monitor.routers import public_api
@@ -50,9 +51,12 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# Mount static files
+# Mount static files (before CSRF middleware to allow access without token)
 app.mount("/static", StaticFiles(directory=str(PROJECT_ROOT / "static")), name="static")
 
+# CSRF protection middleware
+app.add_middleware(CSRFMiddleware)
+
 # CORS middleware
 app.add_middleware(
     CORSMiddleware,