security: add CSRF protection to all forms

- Add Flask-WTF dependency for CSRF protection
- Initialize CSRFProtect in app.py
- Add CSRF tokens to all POST forms in templates
- Exempt /order JSON API endpoint (uses API key instead)

This protects against Cross-Site Request Forgery attacks on all
admin and user management operations.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

wawi/templates/orders.html

@@ -45,9 +45,11 @@
             <td class="actions">
               {% if not o.done and not o.canceled %}
                 <form method="post" action="{{ url_for('bp.complete_order', order_id=o.id) }}" onsubmit="return confirm('Bestellung als erledigt markieren?');">
+                  <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                   <button class="btn small" type="submit">Erledigt</button>
                 </form>
                 <form method="post" action="{{ url_for('bp.cancel_order', order_id=o.id) }}" onsubmit="return confirm('Bestellung wirklich stornieren?');">
+                  <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                   <button class="btn small danger" type="submit">Stornieren</button>
                 </form>
               {% else %}