The lusca CSRF implementation was breaking login and registration because
the frontend doesn't fetch or send CSRF tokens. This is a structural issue
that requires frontend implementation.
As a pragmatic fix, this commit exempts public unauthenticated endpoints
from CSRF protection:
- /api/login, /api/register, /api/verify-email
- /api/version, /api/registration-status, /api/health
- /api/oidc/* (all OIDC authentication endpoints)
- /api/feature-flags
Authenticated endpoints still require CSRF tokens via lusca.
Also updates csrf.js to use lusca's token generation mechanism, making
it compatible with the global lusca CSRF middleware.
TODO: Implement proper CSRF token handling in the frontend for enhanced
security on public endpoints.
a89f2b72d9