security: fix CSRF token validation alerts

[Codewriter90x]

Summary

• stop API JWT authentication from accepting authCookie as a bearer-token fallback
• mark stateless API controllers as anti-forgery exempt for CodeQL while keeping bearer-token auth
• add anti-forgery token propagation for WebApp internal POST/AJAX endpoints
• route session refresh through same-origin WebApp endpoint protected by anti-forgery
• add regression coverage for cookie-only JWT API requests

Verification

• git diff --check
• dotnet build OpenCashFlow.sln --configuration Release --no-restore
• dotnet test OpenCashFlow.sln --configuration Release --no-build
• docker compose config