feat: add CSRF protection, SSRF prevention, and login rate limiting

Security hardening implementing three issues:

CSRF Protection (#35):
- Session-based CSRF tokens with cryptographically random generation
- Constant-time token comparison to prevent timing attacks
- CSRF middleware applied to /pages, /sources, /source, and /user routes
- Hidden csrf_token field added to all 12+ POST forms in templates
- Excluded from /webhook (inbound) and /api (stateless) routes

SSRF Prevention (#36):
- ValidateTargetURL blocks private/reserved IP ranges at target creation
- Blocked ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12,
  192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, fe80::/10, plus
  multicast, reserved, test-net, and CGN ranges
- SSRF-safe HTTP transport with custom DialContext for defense-in-depth
  at delivery time (prevents DNS rebinding attacks)
- Only http/https schemes allowed

Login Rate Limiting (#37):
- Per-IP rate limiter using golang.org/x/time/rate
- 5 attempts per minute per IP on POST /pages/login
- GET requests (form rendering) pass through unaffected
- Automatic cleanup of stale per-IP limiter entries
- X-Forwarded-For and X-Real-IP header support for reverse proxies

Closes #35, closes #36, closes #37

README.md

@@ -710,7 +710,8 @@ webhooker/
 │   │   └── globals.go         # Build-time variables (appname, version, arch)
 │   ├── delivery/
 │   │   ├── engine.go          # Event-driven delivery engine (channel + timer based)
-│   │   └── circuit_breaker.go # Per-target circuit breaker for HTTP targets with retries
+│   │   ├── circuit_breaker.go # Per-target circuit breaker for HTTP targets with retries
+│   │   └── ssrf.go            # SSRF prevention (IP validation, safe HTTP transport)
 │   ├── handlers/
 │   │   ├── handlers.go        # Base handler struct, JSON helpers, template rendering
 │   │   ├── auth.go            # Login, logout handlers
@@ -724,7 +725,9 @@ webhooker/
 │   ├── logger/
 │   │   └── logger.go          # slog setup with TTY detection
 │   ├── middleware/
-│   │   └── middleware.go      # Logging, CORS, Auth, Metrics, MetricsAuth, SecurityHeaders, MaxBodySize
+│   │   ├── middleware.go      # Logging, CORS, Auth, Metrics, MetricsAuth, SecurityHeaders, MaxBodySize
+│   │   ├── csrf.go            # CSRF protection middleware (session-based tokens)
+│   │   └── ratelimit.go       # Per-IP rate limiting middleware (login endpoint)
 │   ├── server/
 │   │   ├── server.go          # Server struct, fx lifecycle, signal handling
 │   │   ├── http.go            # HTTP server setup with timeouts
@@ -811,6 +814,17 @@ Additionally, form endpoints (`/pages`, `/sources`, `/source/*`) apply a
   (`nosniff`), X-Frame-Options (`DENY`), Content-Security-Policy, Referrer-Policy,
   and Permissions-Policy
 - Request body size limits (1 MB) on all form POST endpoints
+- **CSRF protection** on all state-changing forms (session-based tokens
+  with constant-time comparison). Applied to `/pages`, `/sources`,
+  `/source`, and `/user` routes. Excluded from `/webhook` (inbound
+  webhook POSTs) and `/api` (stateless API)
+- **SSRF prevention** for HTTP delivery targets: private/reserved IP
+  ranges (RFC 1918, loopback, link-local, cloud metadata) are blocked
+  both at target creation time (URL validation) and at delivery time
+  (custom HTTP transport with SSRF-safe dialer that validates resolved
+  IPs before connecting, preventing DNS rebinding attacks)
+- **Login rate limiting**: per-IP rate limiter on the login endpoint
+  (5 attempts per minute per IP) to prevent brute-force attacks
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
   runtime)
@@ -895,7 +909,12 @@ linted, tested, and compiled.
 ### Remaining: Core Features
 - [ ] Per-webhook rate limiting in the receiver handler
 - [ ] Webhook signature verification (GitHub, Stripe formats)
-- [ ] CSRF protection for forms
+- [x] CSRF protection for forms
+      ([#35](https://git.eeqj.de/sneak/webhooker/issues/35))
+- [x] SSRF prevention for HTTP delivery targets
+      ([#36](https://git.eeqj.de/sneak/webhooker/issues/36))
+- [x] Login rate limiting (per-IP brute-force protection)
+      ([#37](https://git.eeqj.de/sneak/webhooker/issues/37))
 - [ ] Session expiration and "remember me"
 - [ ] Password change/reset flow
 - [ ] API key authentication for programmatic access