Get a CSRF token for cookie-authenticated requests.

This endpoint sets a CSRF token in an HttpOnly cookie and returns the same token in the JSON body. Clients store the body token (e.g., in memory or localStorage) and send it via the X-CSRF-Token header on all state-changing requests. The browser sends the cookie automatically; the server validates header == cookie (double-submit pattern).

Desktop apps using Bearer authentication do not need CSRF tokens.