security: exempt [ApiController] classes from antiforgery validation

API controllers (Chat, McpToken, ListingSourceCode) are called from JS
clients and bearer token auth - they don't use cookie-based auth so CSRF
doesn't apply. Adding [IgnoreAntiforgeryToken] to each prevents the global
AutoValidateAntiforgeryToken filter from rejecting their requests.

Author: BenjaminMichaelis

EssentialCSharp.Web/Controllers/ChatController.cs

@@ -10,6 +10,7 @@ namespace EssentialCSharp.Web.Controllers;
 [Route("api/[controller]")]
 [Authorize]
 [EnableRateLimiting("ChatEndpoint")]
+[IgnoreAntiforgeryToken]
 public partial class ChatController : ControllerBase
 {
     private readonly AIChatService _AiChatService;

EssentialCSharp.Web/Controllers/ListingSourceCodeController.cs

@@ -5,6 +5,7 @@ namespace EssentialCSharp.Web.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[IgnoreAntiforgeryToken]
 public class ListingSourceCodeController : ControllerBase
 {
     private readonly IListingSourceCodeService _ListingSourceCodeService;

EssentialCSharp.Web/Controllers/McpTokenController.cs

@@ -9,6 +9,7 @@ namespace EssentialCSharp.Web.Controllers;
 [Route("api/[controller]")]
 [Authorize]
 [ResponseCache(Location = ResponseCacheLocation.None, NoStore = true)]
+[IgnoreAntiforgeryToken]
 public class McpTokenController(McpApiTokenService tokenService) : ControllerBase
 {
     public record CreateTokenRequest(string? Name, DateOnly? ExpiresOn = null);