Reject cross-site POSTs to state-changing API routes

[urmeo]

Problem

In no-key local mode the API is open by design, but that also means a web page the user merely visits can submit an HTML <form> to http://127.0.0.1:8000/api/ingest and poison the local corpus. A form POST is a CORS simple request — it runs with no preflight, so the CORS config never blocks the side effect (it only blocks the attacker from reading the response). Classic CSRF.

Fix

New require_same_site dependency on the four state-changing routes (POST /ingest, POST /query, DELETE /documents, DELETE /documents/{id}). It trusts the browser-set Sec-Fetch-Site header (rejects cross-site), falls back to an Origin allowlist for older browsers, and allows requests carrying neither header (curl, the CLI, server-to-server) since those have no ambient-credential CSRF surface.

Verification

• 6 new unit tests in test_security.py (cross-site rejected, same-origin/none/no-header allowed, Origin fallback both ways).
• End-to-end through TestClient: cross-site form POST to /api/ingest → 403; same-origin → 200.
• Full suite green: 27 security + 62 route tests pass.

Closes #13