fix(security): default CSRF origin validation to block mode

[2witstudios]

Summary

• Flipped default ORIGIN_VALIDATION_MODE from warn to block — misconfigured or missing config no longer silently degrades CSRF protection
• Warn mode is now opt-in via explicit ORIGIN_VALIDATION_MODE=warn (for debugging only)
• Bearer token requests unaffected — requests without an Origin header (curl, MCP, mobile apps) are still allowed through, as they are not browser-initiated CSRF vectors

Test plan

• All 53 origin-validation tests pass with updated expectations
• All 22 csrf-validation tests pass (unchanged)
• All 37 auth-middleware tests pass (unchanged)
• Verify production .env already has ORIGIN_VALIDATION_MODE=block (no-op change)
• Verify dev environments explicitly set ORIGIN_VALIDATION_MODE=warn if needed

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[2witstudios]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Reviewed: logic changes in getOriginValidationMode(), test updates (53 origin-validation tests), documentation updates, and .env.example defaults. Verified against git history that the warn-to-block default change completes the phased security rollout originally planned in PR #151.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}