Final fix CSRF unsafe POST guard for remaining UAT VAPT failures

app/main.py

@@ -6,6 +6,7 @@ from app.core.settings import get_settings
 from app.core.middleware.context import ContextResolveMiddleware
 from app.core.middleware.domain_resolver import DomainResolverMiddleware
 from app.core.middleware.security_headers import SecurityHeadersMiddleware
+from app.core.middleware.csrf_guard import CsrfPostGuardMiddleware
 from app.core.startup import on_startup
 from app.core.api import api_router
 from app.core.http_responses import auth_required_response, forbidden_response, not_found_response, wants_json
@@ -45,6 +46,9 @@ def create_app() -> FastAPI:
     # Phase 7T.2: added after context so it resolves the request host before
     # context-aware middleware/routes need tenant/branch/domain state.
     app.add_middleware(DomainResolverMiddleware)
+    # Runs after SessionMiddleware has populated request.session and before routes.
+    # It only guards selected UI unsafe POST endpoints and does not change valid forms.
+    app.add_middleware(CsrfPostGuardMiddleware)
     # SessionMiddleware is added last so it is available to downstream
     # middleware/routes in Starlette's middleware execution order.
     app.add_middleware(