security(admin): same-origin CSRF gate + super_admin-only rate-limit config writes [qa twin of #152]
- security(admin): same-origin CSRF gate in middleware + super_admin-only rate-limit config writes
- Merge pull request #153 from tpromni/security/admin-csrf-origin-hardening
Source: tpromni/coach-pulse-admin-ui → qa