Fix token form CSRF validation

[bradleymackey]

Summary

• render the authenticated session CSRF token directly into token create and revoke forms
• remove the Tokens page's dependency on JavaScript submit-time field injection for native form posts
• add route-level coverage for native forms, HTMX, missing and invalid CSRF tokens, expired sessions, and one-time raw-token display

Validation

• DATABASE_URL=postgres://track:track@localhost:5436/track?sslmode=disable go test -count=1 -run 'TestUITokensPageCreatesAndRevokesToken|TestUITokenCreationCSRFVariants' ./internal/server
• go test -count=1 -run 'TestUISessionCSRFToken|TestUICSRFMiddleware|TestUIClientAssetsSendCSRFTokens' ./internal/server
• DATABASE_URL=postgres://track:track@localhost:5436/track?sslmode=disable go test -count=1 -coverprofile=/tmp/track39-server-cover.out ./internal/server (67.0%)