feat: add CSRF protection, SSRF prevention, and login rate limiting

Security hardening implementing three issues:

CSRF Protection (#35):
- Session-based CSRF tokens with cryptographically random generation
- Constant-time token comparison to prevent timing attacks
- CSRF middleware applied to /pages, /sources, /source, and /user routes
- Hidden csrf_token field added to all 12+ POST forms in templates
- Excluded from /webhook (inbound) and /api (stateless) routes

SSRF Prevention (#36):
- ValidateTargetURL blocks private/reserved IP ranges at target creation
- Blocked ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12,
  192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, fe80::/10, plus
  multicast, reserved, test-net, and CGN ranges
- SSRF-safe HTTP transport with custom DialContext for defense-in-depth
  at delivery time (prevents DNS rebinding attacks)
- Only http/https schemes allowed

Login Rate Limiting (#37):
- Per-IP rate limiter using golang.org/x/time/rate
- 5 attempts per minute per IP on POST /pages/login
- GET requests (form rendering) pass through unaffected
- Automatic cleanup of stale per-IP limiter entries
- X-Forwarded-For and X-Real-IP header support for reverse proxies

Closes #35, closes #36, closes #37

internal/server/routes.go

@@ -64,13 +64,18 @@ func (s *Server) SetupRoutes() {
 		})
 	}
 
-	// pages that are rendered server-side
+	// pages that are rendered server-side — CSRF-protected, body-size
+	// limited, and with per-IP rate limiting on the login endpoint.
 	s.router.Route("/pages", func(r chi.Router) {
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 
-		// Login page (no auth required)
-		r.Get("/login", s.h.HandleLoginPage())
-		r.Post("/login", s.h.HandleLoginSubmit())
+		// Login page — rate-limited to prevent brute-force attacks
+		r.Group(func(r chi.Router) {
+			r.Use(s.mw.LoginRateLimit())
+			r.Get("/login", s.h.HandleLoginPage())
+			r.Post("/login", s.h.HandleLoginSubmit())
+		})
 
 		// Logout (auth required)
 		r.Post("/logout", s.h.HandleLogout())
@@ -78,11 +83,13 @@ func (s *Server) SetupRoutes() {
 
 	// User profile routes
 	s.router.Route("/user/{username}", func(r chi.Router) {
+		r.Use(s.mw.CSRF())
 		r.Get("/", s.h.HandleProfile())
 	})
 
-	// Webhook management routes (require authentication)
+	// Webhook management routes (require authentication, CSRF-protected)
 	s.router.Route("/sources", func(r chi.Router) {
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceList())             // List all webhooks
@@ -91,6 +98,7 @@ func (s *Server) SetupRoutes() {
 	})
 
 	s.router.Route("/source/{sourceID}", func(r chi.Router) {
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceDetail())                                       // View webhook details