Add CSRF protection to all POST endpoints with double-submit cookie pattern

[capy-ai]

This PR adds CSRF protection to all Finch POST endpoints using the double-submit cookie pattern. The implementation generates random 32-byte tokens on GET requests that render forms, sets them as httpOnly cookies, embeds them in hidden form fields, and validates them on POST submissions.

What's added

• CSRF helpers — New src/csrf.nim module with generateCsrfToken() and csrfTokensMatch() procs
• Route protection — All 24 POST handlers in src/routes/local.nim now call validateCsrf() before processing
• Preferences routes — All 3 POST handlers in src/routes/preferences.nim protected with CSRF validation
• Token generation — GET handlers that render forms now call setCsrfCookie() and inject csrfToken into views
• Form updates — src/views/identity.nim, src/views/preferences.nim, and src/views/renderutils.nim add hidden CSRF input fields
• Helper utilities — csrfField() and updated buttonReferer() in src/views/renderutils.nim for consistent token inclusion