fix: CSRF token retry re-read stale <meta> tag instead of fetching a live token, causing permanent CSRF failures after any server restart

Upload codebase with API and Dockerfile