fix(#351): CSRF-403 bei KI-Chat und Wiki-Save behoben — /auth/me liefert csrf_token, streamChat nutzt gemeinsamen Client-Token statt totem sessionStorage-Key; Regressionstests pytest+vitest

tests/test_auth.py

@@ -60,6 +60,24 @@ class TestAuthMe:
         assert "tenant_id" in data
         assert "tenant_name" in data
 
+    async def test_me_returns_csrf_token_for_reload_restore(self, client: AsyncClient, db_session):
+        """Regression (403 after page reload): /me returns the session csrf_token
+        so the frontend can restore it and mutations keep working."""
+        await seed_tenant_and_users(db_session)
+        login_resp = await client.post(
+            "/api/v1/auth/login",
+            json={"email": "admin@tenanta.com", "password": "TestPass123!"},
+            headers=ORIGIN_HEADER,
+        )
+        assert login_resp.status_code == 200
+        login_data = login_resp.json()
+        csrf_from_login = login_data["csrf_token"]
+
+        resp = await client.get("/api/v1/auth/me")
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["csrf_token"] == csrf_from_login
+
 
 @pytest.mark.asyncio
 class TestAuthLogout: