Add CSRF protection and GET /api/v1/me

RequireSession now stores the validated session in the request context
(auth.WithSession / auth.SessionFrom); auth.ActorFrom derives the actor
from it, so there is one context value.

Every /api/v1 request other than GET, HEAD and OPTIONS must carry
X-MealQuest-CSRF equal to the session's csrf_token (constant-time
compare), else 403 {"error":{"code":"csrf"}}. The check runs after
RequireSession, so unauthenticated requests still get 401. A session
with no token is a 500, never a match against a missing header.

GET /api/v1/me returns {name, email, household: {label: "Our kitchen"},
csrfToken} with Cache-Control: no-store.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/session_test.go

@@ -21,10 +21,11 @@ var (
 	validSessionCookie  = &http.Cookie{Name: auth.SessionCookieName, Value: "valid"}
 	brokenSessionCookie = &http.Cookie{Name: auth.SessionCookieName, Value: "broken"}
 	testSession         = auth.Session{
-		Subject: "user-123",
-		Email:   "cook@example.com",
-		Name:    "Home Cook",
-		Groups:  []string{"mealquest-admin"},
+		Subject:   "user-123",
+		Email:     "cook@example.com",
+		Name:      "Home Cook",
+		Groups:    []string{"mealquest-admin"},
+		CSRFToken: "csrf-token-123",
 	}
 )