feat(security): Phase 20 CSRF 防護實作

Phase 19 首席架構師審查指出: 核鑰 UX 安全性缺 CSRF 防護

後端:
- 新增 src/core/csrf.py (Double Submit Cookie 模式)
- 新增 src/api/v1/csrf.py (GET /api/v1/csrf/token)
- 新增 src/models/csrf.py (CSRFTokenResponse)
- 修改 approvals.py sign/reject/bulk 端點加入 CSRFToken 驗證

前端:
- 新增 hooks/useCSRF.ts (React Hook)
- 修改 approval.store.ts 整合 CSRF Token 參數

安全特性:
- 256-bit Token (secrets.token_hex)
- 時序安全比較 (secrets.compare_digest)
- SameSite=Strict Cookie
- 1 小時 Token 有效期

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/main.py

@@ -33,6 +33,7 @@ from sentry_sdk.integrations.starlette import StarletteIntegration
 from src.api.v1 import agents as agents_v1  # Phase 9.5: Agent Teams API
 from src.api.v1 import ai as ai_v1
 from src.api.v1 import approvals as approvals_v1
+from src.api.v1 import csrf as csrf_v1  # Phase 20: CSRF Protection
 from src.api.v1 import audit_logs as audit_logs_v1
 from src.api.v1 import auto_repair as auto_repair_v1  # #8: 自動升級決策
 from src.api.v1 import dashboard as dashboard_v1
@@ -370,6 +371,7 @@ async def global_exception_handler(_request: Request, exc: Exception) -> JSONRes
 
 # New v1 API routes
 app.include_router(health_v1.router, prefix="/api/v1", tags=["Health"])
+app.include_router(csrf_v1.router, prefix="/api/v1", tags=["Security"])  # Phase 20
 app.include_router(dashboard_v1.router, prefix="/api/v1", tags=["Dashboard"])
 app.include_router(approvals_v1.router, prefix="/api/v1", tags=["HITL Approvals"])
 app.include_router(ai_v1.router, prefix="/api/v1", tags=["AI Decision"])