security: add CSRF protection to all forms

- Add Flask-WTF dependency for CSRF protection
- Initialize CSRFProtect in app.py
- Add CSRF tokens to all POST forms in templates
- Exempt /order JSON API endpoint (uses API key instead)

This protects against Cross-Site Request Forgery attacks on all
admin and user management operations.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

wawi/templates/ausbuchen.html

@@ -4,6 +4,7 @@
     <h2>Ausbuchen: {{ item.artikel }} ({{ item.groesse }})</h2>
     <div class="note">Aktueller Bestand: <strong>{{ item.gezaehlt }}</strong></div>
     <form method="post" onsubmit="return confirm('Wirklich ausbuchen?');">
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
       <div class="form-grid">
         <label>
           Menge