Add CSRF protection for picker model switching

[ChengShiLiu16]

Summary

Adds a per-process picker token for the state-changing /api/switch endpoint.

The picker page embeds the token and sends it via X-Codex-Shim-Picker-Token when switching models. Requests without the token, or with an invalid token, are rejected with 403.

Why

The existing Host-header allowlist protects against DNS rebinding, but /api/switch is a local control-plane write endpoint: it rewrites ~/.codex/config.toml and can optionally restart Codex Desktop. Requiring a picker token prevents third-party pages from triggering model switches just because the loopback server is reachable.

Tests

• python3 -m compileall codex_shim/ -q
• python3 -m py_compile tests/test_server.py tests/test_router_integration.py
• uv run --isolated --python 3.11 --with aiohttp --with pytest --with pytest-asyncio python -m pytest tests/test_server.py tests/test_router_integration.py tests/test_hostguard.py -q
• uv run --isolated --python 3.11 --with aiohttp --with pytest --with pytest-asyncio python -m pytest tests/ -q
• git diff --check

[OnlyTerp]

Integrated in #36 (CSRF token protection for /api/switch). Thanks for the contribution — credited in the PR summary.

[OnlyTerp]

Closing as superseded — this work was integrated and merged in #36. Thank you for the contribution!