DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests

dashcaddy-api/src/security/csrf-protection.js

@@ -195,7 +195,10 @@ function csrfValidationMiddleware(req, res, next) {
       return new RegExp(pattern).test(req.path);
     }
     return false;
-  }) || req.path.startsWith('/api/v1/auth/gate/');
+  }) || req.path.startsWith('/api/v1/auth/gate/')
+    // DC-154: Caddy forward_auth fires on every protected request including
+    // POSTs — it presents a device identity (whois), never a CSRF token.
+    || req.path.startsWith('/api/v1/network/forward-auth');
 
   if (isExcluded) {
     return next();