test : added unit tests for csrf helpers

[tmdeveloper007]

Closes #2460.

Summary of What Has Been Done:
Added a dedicated vitest test file test/csrf.test.ts that pins the behaviour of every export in src/lib/csrf.ts: isStateChangingMethod, isCsrfExempt, and validateCsrf. Tests are deterministic and hermetic — they set and clear the relevant process.env entries in beforeEach/afterEach so they do not leak state between cases.

Changes Made:

• New file: test/csrf.test.ts (17 tests, all passing under npm test).
• Coverage:
  • isStateChangingMethod — true for POST/PUT/PATCH/DELETE; false for GET/HEAD/OPTIONS/TRACE/empty/arbitrary strings.
  • isCsrfExempt — true for the webhook prefixes (/api/webhooks/github, /api/webhooks/custom, /api/webhooks/dispatch) and the rate-limited API prefixes (/api/metrics, /api/auth/signin, /api/auth/callback); false for ordinary API routes like /api/goals, /api/user/settings, and /api/streak/freeze.
  • validateCsrf — covered for: missing origin AND referer; origin exact match; origin mismatch; hostile prefix like https://app.example.com.evil.test; sub-path origin (/callback); trailing-slash stripping in configured origins; referer-only fallback; referer mismatch; open behaviour when no allowed origins are configured; merging of ALLOWED_ORIGINS with NEXTAUTH_URL and NEXT_PUBLIC_APP_URL.
• A small makeRequest helper stands in for NextRequest so tests don't need to import the Next runtime.

Impact it Made:
Locks the CSRF protection contract: future refactors that change the webhook/rate-limit prefix lists, the origin match policy, or the env-var merge order will surface a unit-test failure rather than a silent security regression. No production code is modified; the change is limited to one new test file.

[github-actions]

GSSoC Label Checklist 🏷️

@Umbrella-io — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus