sec(api): PATCH requests skip CSRF validation (plans and ladder tranche edits) #1101

Found while documenting the API in #262 (PR #1100).

requiresCSRFValidation in internal/api/middleware.go only enforces CSRF on POST, PUT and DELETE:

// Only POST, PUT, DELETE need CSRF protection
if method != "POST" && method != "PUT" && method != "DELETE" {
    return false
}

Two routes change state through PATCH with AuthUser, so a session-authenticated request reaches them with no CSRF check:

• PATCH /api/plans/{id} (patchPlanHandler, router.go:152)
• PATCH /api/ladder/tranches/{id} (amendLadderTrancheHandler, router.go:334)

Suggested fix: treat every method except GET, HEAD and OPTIONS as state-changing, so future verbs are covered too. Add a test that a session PATCH without X-CSRF-Token is refused on both routes, plus a guard test that every non-safe-method route requires CSRF.