feat: add CSRF protection plugin

[Taure]

Summary

• Add nova_csrf_plugin — CSRF protection using the synchronizer token pattern (generate random token per session, validate on POST/PUT/PATCH/DELETE)
• Fix first-request session availability — nova_stream_h now injects the new session ID into the Req map so nova_session can use it immediately, instead of waiting for the cookie round-trip
• Inject csrf_token into template variables in nova_basic_handler:handle_view/4 so templates can use {{ csrf_token }}

Details

Plugin options:

• field_name — form field name (default _csrf_token)
• header_name — header name (default x-csrf-token)
• session_key — session storage key (default _csrf_token)
• excluded_paths — list of path prefixes to skip

Token lookup order: x-csrf-token header first, then _csrf_token in parsed form params. Uses crypto:hash_equals/2 for constant-time comparison.

Requires nova_request_plugin to run before nova_csrf_plugin so form params are parsed.

Test plan

• Token generation (binary, correct length, unique)
• Constant-time comparison (equal, different, different length, undefined)
• Safe method detection (GET/HEAD/OPTIONS safe; POST/PUT/PATCH/DELETE unsafe)
• Path exclusion (prefix match, no match, empty list)
• Submitted token extraction (from header, from params, header priority, missing)
• Integration tests with meck for full pre_request/4 flow
• 42 tests pass, dialyzer clean

🤖 Generated with Claude Code