feat: add CSRF protection, SSRF prevention, and login rate limiting (#42)

## Security Hardening

This PR implements three security hardening issues:

### CSRF Protection (closes #35)

- Session-based CSRF tokens with cryptographically random 256-bit generation
- Constant-time token comparison to prevent timing attacks
- CSRF middleware applied to `/pages`, `/sources`, `/source`, and `/user` routes
- Hidden `csrf_token` field added to all 12+ POST forms in templates
- Excluded from `/webhook` (inbound webhook POSTs) and `/api` (stateless API)

### SSRF Prevention (closes #36)

- `ValidateTargetURL()` blocks private/reserved IP ranges at target creation time
- Blocked ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`, plus multicast, reserved, test-net, and CGN ranges
- SSRF-safe HTTP transport with custom `DialContext` in the delivery engine for defense-in-depth (prevents DNS rebinding attacks)
- Only `http` and `https` schemes allowed

### Login Rate Limiting (closes #37)

- Per-IP rate limiter using `golang.org/x/time/rate`
- 5 attempts per minute per IP on `POST /pages/login`
- GET requests (form rendering) pass through unaffected
- Automatic cleanup of stale per-IP limiter entries every 5 minutes
- `X-Forwarded-For` and `X-Real-IP` header support for reverse proxies

### Files Changed

**New files:**
- `internal/middleware/csrf.go` + tests — CSRF middleware
- `internal/middleware/ratelimit.go` + tests — Login rate limiter
- `internal/delivery/ssrf.go` + tests — SSRF validation + safe transport

**Modified files:**
- `internal/server/routes.go` — Wire CSRF and rate limit middleware
- `internal/handlers/handlers.go` — Inject CSRF token into template data
- `internal/handlers/source_management.go` — SSRF validation on target creation
- `internal/delivery/engine.go` — SSRF-safe HTTP transport for production
- All form templates — Added hidden `csrf_token` fields
- `README.md` — Updated Security section and TODO checklist

`docker build .` passes (lint + tests + build).

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Co-authored-by: clawbot <clawbot@eeqj.de>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #42
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/middleware/csrf.go

@@ -0,0 +1,56 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/gorilla/csrf"
+)
+
+// CSRFToken retrieves the CSRF token from the request context.
+// Returns an empty string if the gorilla/csrf middleware has not run.
+func CSRFToken(r *http.Request) string {
+	return csrf.Token(r)
+}
+
+// CSRF returns middleware that provides CSRF protection using the
+// gorilla/csrf library. The middleware uses the session authentication
+// key to sign a CSRF cookie and validates a masked token submitted via
+// the "csrf_token" form field (or the "X-CSRF-Token" header) on
+// POST/PUT/PATCH/DELETE requests. Requests with an invalid or missing
+// token receive a 403 Forbidden response.
+//
+// In development mode, requests are marked as plaintext HTTP so that
+// gorilla/csrf skips the strict Referer-origin check (which is only
+// meaningful over TLS).
+func (m *Middleware) CSRF() func(http.Handler) http.Handler {
+	protect := csrf.Protect(
+		m.session.GetKey(),
+		csrf.FieldName("csrf_token"),
+		csrf.Secure(!m.params.Config.IsDev()),
+		csrf.SameSite(csrf.SameSiteLaxMode),
+		csrf.Path("/"),
+		csrf.ErrorHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			m.log.Warn("csrf: token validation failed",
+				"method", r.Method,
+				"path", r.URL.Path,
+				"remote_addr", r.RemoteAddr,
+				"reason", csrf.FailureReason(r),
+			)
+			http.Error(w, "Forbidden - invalid CSRF token", http.StatusForbidden)
+		})),
+	)
+
+	// In development (plaintext HTTP), signal gorilla/csrf to skip
+	// the strict TLS Referer check by injecting the PlaintextHTTP
+	// context key before the CSRF handler sees the request.
+	if m.params.Config.IsDev() {
+		return func(next http.Handler) http.Handler {
+			csrfHandler := protect(next)
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				csrfHandler.ServeHTTP(w, csrf.PlaintextHTTPRequest(r))
+			})
+		}
+	}
+
+	return protect
+}