test: add CSRF origin and Referer coverage

[vreabernardo]

Closes #296.

Adds direct coverage for CSRF expected-origin resolution and mutation header validation. The headerless POST case is pinned to the current fail-closed 403 behavior from #316.

Tests:

• node --test test-dist/test/csrf.test.js: 12 passed, 0 failed.
• node --experimental-test-coverage --test test-dist/test/csrf.test.js: lib/csrf.ts reached 100% line, branch, and function coverage.
• npm test: this branch and upstream main both stop before execution on the same 3 existing TypeScript diagnostics in components/nav.tsx.
• Emitted full suite: branch 467 passed / 1 failed; main 455 passed / 1 failed. Both have the same existing member-cache.test.js configuration failure.
• npm run typecheck: branch and main both report the same 17 existing errors.
• npm run lint: branch and main both report the same 8 existing react/no-unescaped-entities errors.
• npm run check-types: passes on branch and main.
• npm ci: cannot start because the upstream lockfile omits es-abstract@1.24.2; dependencies were installed with npm install --package-lock=false instead.

[vreabernardo]

Withdrawing this contribution. Thanks for your time.