Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS

F03-01: go-oidc embeds the provider's response body in its error for a
non-200 discovery response, which cmd/server logged at startup. Discovery
now runs through a status-recording transport and a non-200 response is
reported as "provider answered HTTP <status>" only; transport errors keep
their cause. A test with a sentinel body proves it reaches neither the
error nor the log.

F03-02: the CSRF middleware exempts only GET, so HEAD and OPTIONS under
/api/v1 without X-MealQuest-CSRF get 403 csrf, matching CONTEXT.MD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/csrf.go

@@ -12,7 +12,7 @@ import (
 // GET /api/v1/me.
 const CSRFHeader = "X-MealQuest-CSRF"
 
-// requireCSRF passes GET, HEAD and OPTIONS requests to next; every other
+// requireCSRF passes GET requests to next; every other
 // request must carry CSRFHeader equal to its session's CSRF token or get 403
 // csrf. It runs behind requireSession, which puts the session in the context.
 func requireCSRF(logger *slog.Logger) func(http.Handler) http.Handler {
@@ -21,7 +21,7 @@ func requireCSRF(logger *slog.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			switch r.Method {
-			case http.MethodGet, http.MethodHead, http.MethodOptions:
+			case http.MethodGet:
 				next.ServeHTTP(w, r)
 				return
 			}