Add form handling and CSRF protection middleware

ai/rules/review.mdc

@@ -15,6 +15,7 @@ Criteria {
   Use autodux.mdc for Redux state management patterns and Autodux usage.
   Use javascript-io-network-effects.mdc for network effects and side effect handling.
   Use commit.mdc for commit message quality and conventional commit format.
+  Use security/timing-safe-compare.mdc when reviewing secret/token comparisons (CSRF, API keys, sessions). Flag crypto.timingSafeEqual or raw token comparisons as CRITICAL.
   Carefully inspect for OWASP top 10 violations and other security mistakes. Use search. Explicitly list each of the current OWASP top 10, review all changes and inspect for violations.
   Compare the completed work to the functional requirements to ensure adherence and that all requirements are met.
   Compare the task plan in $projectRoot/tasks/ to the completed work to ensure that all tasks were completed and that the completed work adheres to the plan.

ai/rules/security/timing-safe-compare.mdc

@@ -0,0 +1,23 @@
+---
+description: Security rule for timing-safe secret comparison. Use SHA3 hashing instead of timing-safe compare functions.
+alwaysApply: false
+---
+
+# Constraint: Timing Safe Compare
+
+There is no timing safe compare for raw values. Never use:
+- crypto.timingSafeEqual
+- XOR accumulation tricks
+- any direct string compare on raw secrets
+
+Always hash both the stored secret token and the candidate token with SHA3, then compare the hashes.
+
+Reasons:
+1. Hashing removes all prefix structure. Any bit change fully randomizes the hash. No timing oracle. No hangman.
+2. Raw secrets never appear in logs or errors.
+
+(timing safe compare needed?) => Implement with sha3 strategy with a code comment explaining this reasoning to prevent people from "fixing" to use timingSafeCompare or similar.
+
+This rule overrides all library defaults.
+
+("timing safe compare" detected) => raise CRITICAL security bug report, "Timing safe compare on raw value detected" - include justifications.