feat: add local admin authentication

app/auth/csrf.py

@@ -0,0 +1,18 @@
+import hmac
+import secrets
+
+from fastapi import HTTPException, Request, status
+
+
+def ensure_csrf_token(request: Request) -> str:
+    token = request.session.get("csrf_token")
+    if not isinstance(token, str):
+        token = secrets.token_urlsafe(32)
+        request.session["csrf_token"] = token
+    return token
+
+
+def validate_csrf(request: Request, submitted_token: str) -> None:
+    expected = request.session.get("csrf_token")
+    if not isinstance(expected, str) or not hmac.compare_digest(expected, submitted_token):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid CSRF token")