fix(security): guard external hrefs and refine CSRF/auth-loading handling

- Add safeExternalHref(): only render http(s) URLs as clickable hrefs,
  blocking attacker-controlled template metadata from becoming
  javascript:/data: links.
- Refine CSRF header attachment and auth-loading state in the fetcher,
  api-tokens client, useAuth, and settings route.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/lib/utils.ts

@@ -133,6 +133,19 @@ export function formatPath(path: string) {
     return path.replace(/\/{2,}/g, "/")
 }
 
+// Returns the URL only if it uses an http(s) scheme, else undefined. Guards
+// against rendering attacker-controlled template metadata as a clickable
+// javascript:/data: href.
+export function safeExternalHref(url?: string): string | undefined {
+    if (!url) return undefined
+    try {
+        const parsed = new URL(url, window.location.origin)
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.href : undefined
+    } catch {
+        return undefined
+    }
+}
+
 export function joinIP(p?: ModelIP) {
     if (p) {
         if (p.ipv4_addr && p.ipv6_addr) {