security: add CSRF protection to all forms

- Add Flask-WTF dependency for CSRF protection
- Initialize CSRFProtect in app.py
- Add CSRF tokens to all POST forms in templates
- Exempt /order JSON API endpoint (uses API key instead)

This protects against Cross-Site Request Forgery attacks on all
admin and user management operations.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

wawi/app.py

@@ -22,6 +22,7 @@ from datetime import datetime
 from typing import Any
 
 from flask import Flask, Blueprint, g, flash, jsonify, redirect, render_template, request, session, url_for
+from flask_wtf.csrf import CSRFProtect
 from werkzeug.security import check_password_hash, generate_password_hash
 from werkzeug.utils import secure_filename
 
@@ -41,6 +42,10 @@ app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
 app.config["SESSION_COOKIE_SECURE"] = os.environ.get("COOKIE_SECURE", "1") == "1"
 app.config["SESSION_COOKIE_HTTPONLY"] = True
 app.config["MAX_CONTENT_LENGTH"] = 5 * 1024 * 1024
+
+# CSRF-Schutz aktivieren
+csrf = CSRFProtect(app)
+
 bp = Blueprint("bp", __name__)
 
 UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
@@ -597,6 +602,7 @@ def build_bestand() -> list[dict]:
 
 
 @bp.route("/order", methods=["POST"])
+@csrf.exempt  # JSON API ohne CSRF-Schutz (nutzt API-Key stattdessen)
 def order():
     """Erstellt eine Bestellung (optional API‑Key) und versendet Mail."""
     ip = request.headers.get("X-Forwarded-For", request.remote_addr or "unknown").split(",")[0].strip()