Refactor backend architecture and update documentation

- Add CSRF protection middleware implementation
- Update API client with improved configuration
- Enhance documentation for backend development
- Add architecture documentation updates
- Reorganize and clean up task documentation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Backend-Development.md

@@ -768,6 +768,50 @@ environment:
 
 **Important:** If `Secure=true` is set, browsers will reject the session cookie when the backend is served over HTTP. Ensure your nginx/reverse proxy terminates TLS and passes `X-Forwarded-Proto: https` so FastAPI knows the connection is secure.
 
+### CSRF Protection Middleware
+
+State-mutating endpoints (POST, PUT, DELETE, PATCH) authenticated via session cookies are protected by the `CsrfMiddleware`, which enforces a custom header check.
+
+**How It Works:**
+
+1. For every request using a mutating HTTP method, the middleware checks:
+   - Is this request authenticated via session cookie (not Bearer token)?
+   - If yes, require the custom header `X-BanGUI-Request: 1`.
+   - If missing or incorrect, return `403 Forbidden`.
+
+2. **Bearer token requests** (via `Authorization: Bearer` header) bypass the check because tokens are not CSRF-vulnerable — they are never automatically sent on cross-origin requests.
+
+3. **Safe HTTP methods** (GET, HEAD, OPTIONS) bypass the check.
+
+4. **Cross-site protection:** Cross-site JavaScript (`fetch()` calls from other origins) cannot set custom headers without CORS preflight, which the backend rejects for non-allowed origins. This provides defense-in-depth against subdomain attacks and XSS injection.
+
+**Implementation Location:**
+- Middleware: `backend/app/middleware/csrf.py`
+- Registered in: `backend/app/main.py` via `app.add_middleware(CsrfMiddleware)`
+
+**Example:**
+```python
+# ✓ Cookie-authenticated POST with CSRF header — allowed
+POST /api/bans
+Cookie: bangui_session=...
+X-BanGUI-Request: 1
+
+# ✗ Cookie-authenticated POST without CSRF header — rejected with 403
+POST /api/bans
+Cookie: bangui_session=...
+(no X-BanGUI-Request header)
+
+# ✓ Bearer token authentication without CSRF header — allowed
+POST /api/bans
+Authorization: Bearer <token>
+(no X-BanGUI-Request header needed)
+
+# ✓ Safe GET method without CSRF header — allowed
+GET /api/jails
+Cookie: bangui_session=...
+(no X-BanGUI-Request header needed)
+```
+
 ### fail2ban_start_command Configuration
 
 The `fail2ban_start_command` setting specifies the shell command used to start the fail2ban daemon during recovery operations (e.g., after a rollback).