CSRF protection on the login and URL-generator forms (closes #93)

Adds CSRF protection to the two cookie-authenticated form posts, POST / (login) and POST /generate, using github.com/gorilla/csrf, the recorded default for this job.

The token key is derived from signing_key with its own HKDF salt, so it needs no new config and survives restarts. The token cookie is separate from the session cookie, which also covers login CSRF, where no session exists yet. Both templates carry the hidden token field.

What a reader would trip over: outside debug mode the library enforces its https Referer origin check, so the TLS-terminating proxy must preserve the Host and Referer headers from the browser or form posts are rejected.

Disclosure: one nolint:gosec on a test constant holding the library field name (G101 false positive).

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)

internal/templates/generator.html

@@ -47,6 +47,7 @@
         {{end}}
 
         <form method="POST" action="/generate" class="bg-white rounded-lg shadow-md p-6 space-y-4">
+            {{ .CSRFField }}
             <div>
                 <label for="url" class="block text-sm font-medium text-gray-700 mb-1">
                     Source URL

internal/templates/login.html

@@ -17,6 +17,7 @@
         {{end}}
 
         <form method="POST" action="/" class="space-y-4">
+            {{ .CSRFField }}
             <div>
                 <label for="key" class="block text-sm font-medium text-gray-700 mb-1">
                     Signing Key