Refactor backend architecture and update documentation

- Add CSRF protection middleware implementation
- Update API client with improved configuration
- Enhance documentation for backend development
- Add architecture documentation updates
- Reorganize and clean up task documentation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/main.py

@@ -57,6 +57,7 @@ from app.exceptions import (
     JailOperationError,
     ServerOperationError,
 )
+from app.middleware.csrf import CsrfMiddleware
 from app.routers import (
     auth,
     bans,
@@ -506,8 +507,11 @@ def create_app(settings: Settings | None = None) -> FastAPI:
 
     # --- Middleware ---
     # Note: middleware is applied in reverse order of registration.
-    # The setup-redirect must run *after* CORS, so it is added last.
+    # The setup-redirect must run *after* CSRF, so it is added last.
+    # CSRF middleware protects cookie-authenticated state-mutating requests.
     app.add_middleware(SetupRedirectMiddleware)
+    app.add_middleware(CsrfMiddleware)
+
 
     # --- Exception handlers ---
     # Ordered from most specific to least specific.  FastAPI evaluates handlers