fix(security): enhance client ID audit logging and CSRF origin validation

[lakhansamani]

Summary

• Client ID logging (MEDIUM): Empty client ID requests now emit debug-level audit log; code documented to explain why empty client ID is allowed (OAuth callbacks, JWKS, health endpoints)
• CSRF origin validation (MEDIUM): CSRF middleware now validates the Origin header against configured AllowedOrigins using the same validator as CORS middleware, rejecting requests from disallowed origins with 403

Files Changed

• internal/http_handlers/client_check.go — audit logging + documentation
• internal/http_handlers/csrf.go — origin validation

Test plan

• make test-sqlite passes (no regressions)
• Verify GraphQL requests without client ID still work
• Verify cross-origin POST requests from disallowed origins are rejected
• Verify same-origin requests pass CSRF check