security: add global AutoValidateAntiforgeryToken filter

Replaces TODO comment with explicit AddControllersWithViews registration that applies AutoValidateAntiforgeryTokenAttribute globally. Ensures all MVC controller POST/PUT/DELETE actions require a valid antiforgery token by default, providing defense-in-depth against CSRF even if individual actions are not annotated.

Author: BenjaminMichaelis

EssentialCSharp.Web/Program.cs

@@ -232,7 +232,10 @@ private static void Main(string[] args)
             throw new NotSupportedException("The default UI requires a user store with password support.");
         });
 
-        //TODO: Implement the anti-forgery token with every POST/PUT request: https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery
+        builder.Services.AddControllersWithViews(options =>
+        {
+            options.Filters.Add(new Microsoft.AspNetCore.Mvc.AutoValidateAntiforgeryTokenAttribute());
+        });
 
         if (!builder.Environment.IsDevelopment())
         {