[LOW] Add CSRF protection documentation to security posture

[kilodesodiq-arch]

Engineering Gap

No CSRF protection middleware configured or documented. Currently mitigated by API key auth pattern, but risk increases if cookie-based sessions are added.

Codebase Evidence

• app/backend/src/main.ts: No CSRF middleware registered
• app/backend/src/common/security/security.module.ts: CORS and helmet only, no CSRF

Risk Profile

Currently low due to API key auth. Risk increases if cookie-based auth added.

Remediation Strategy

Document current CSRF posture: "API uses token-based auth (x-api-key header) which is inherently CSRF-resistant." Note that CSRF middleware should be added if cookie-based sessions are introduced.

Success Conditions

• CSRF posture documented in security module or README

Change Surface

File: app/backend/src/common/security/security.module.ts (comment)

Security Review

Documents defense-in-depth position.

Completion Checklist

• Documentation added
• Ready for merge