Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

src/server.ts

@@ -25,12 +25,14 @@ await runBootHooks(plugins); // plugin onBoot — after discovery, before listen
 const server = createApp({
   auth: { audience: config.jwtAudience, issuer: config.jwtIssuer },
   cache: config.cacheTemplates,
+  csrfSecret: config.csrfSecret,
   jwks,
   keto,
   kratos,
   kratosAdmin,
   menu,
   plugins,
+  secureCookies: config.secureCookies,
 }).listen(config.port, () => {
   console.log(`Listening on http://localhost:${config.port}`);
 });