feat: Implement CSRF protection and PostgreSQL support

- Added CSRF protection mechanism in the backend with utility functions for token management.
- Introduced a new CSRF route to fetch the active CSRF token for SPA bootstrap flows.
- Updated the auth routes to validate CSRF tokens on sensitive operations.
- Configured PostgreSQL as a database option in the environment settings and Docker Compose.
- Created a new SQLite configuration file for local development.
- Enhanced the API client to automatically attach CSRF tokens to requests.
- Updated various frontend components to utilize the new site origin utility for SEO purposes.
- Modified Nginx configuration to improve redirection and SEO headers.
- Added tests for CSRF token handling in the authentication routes.

nginx/nginx.prod.conf

@@ -8,7 +8,7 @@ server {
     client_max_body_size 100M;
 
     # Redirect HTTP to HTTPS
-    return 301 https://dociva.io$request_uri;
+    return 308 https://dociva.io$request_uri;
 }
 
 # Redirect www to non-www
@@ -21,7 +21,7 @@ server {
     ssl_certificate_key /etc/nginx/ssl/privkey.pem;
     ssl_protocols TLSv1.2 TLSv1.3;
 
-    return 301 https://dociva.io$request_uri;
+    return 308 https://dociva.io$request_uri;
 }
 
 server {
@@ -43,6 +43,7 @@ server {
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header X-Canonical-Host "dociva.io" always;
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://pagead2.googlesyndication.com https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://pagead2.googlesyndication.com https://www.google-analytics.com; connect-src 'self' https://www.google-analytics.com https://pagead2.googlesyndication.com https://plausible.io; frame-src https://googleads.g.doubleclick.net https://tpc.googlesyndication.com; frame-ancestors 'self'" always;
 
     # SEO files — no cache, always fresh
@@ -71,6 +72,7 @@ server {
     # Frontend static files
     location / {
         root /usr/share/nginx/html;
+        add_header Link "<https://dociva.io$uri>; rel=canonical" always;
         try_files $uri $uri/ /index.html;
 
         # Cache static assets