feat: CSRF token auto-refresh après expiration session

- app/main.py: GET /api/csrf-token → retourne un token frais JSON + cookie
- app/middleware/csrf.py: /api/csrf-token ajouté aux EXCLUDED_PATHS
- app/templates/base.html:
  - FlowDeck.refreshCsrfToken() → appelle /api/csrf-token
  - FlowDeck.csrfFetch() → wrapper fetch avec auto-refresh sur 403 CSRF
  - Si un POST/PUT/DELETE reçoit 403 'CSRF', refresh automatique + retry
- ROADMAP: item CSRF token refresh marqué ✅
- 143 tests passent

app/main.py

@@ -92,6 +92,20 @@ async def pwa_manifest():
 # ═══════════ API aliases (v4.0.1) ═══════════
 
 
+@app.get("/api/csrf-token")
+async def csrf_token_endpoint(request: Request):
+    """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
+    from fastapi.responses import JSONResponse
+    import secrets
+    token = secrets.token_hex(32)
+    response = JSONResponse({"csrf_token": token})
+    response.set_cookie(
+        "csrf_token", token,
+        httponly=False, samesite="lax", max_age=86400, path="/",
+    )
+    return response
+
+
 @app.get("/api/pages")
 async def api_pages_alias(request: Request):
     """Alias /api/pages → /board/api/pages for API path consistency."""