feat(web): Sprint A4 — sécurité web (B-11 CSRF, M-3 /health) c9d381c unverified Claude commited on May 2