sec: rotate CSRF token + cycle session ID on auth success

Session-fixation hardening. Today, the session ID and CSRF token a pre-auth visitor receives persist across the login boundary. A fixation attack that planted a known session ID before auth would survive the auth event.

Scope:

• On a successful Keycloak callback, rotate tower_sessions session ID via session.cycle_id().await.
• Mint a fresh CSRF token (when CSRF middleware lands per FU-58) at the same moment, so any pre-auth token is invalidated by login.
• Verify in tests: ID + CSRF after login != ID + CSRF before login.

Surfaced as a FU during Stage 5 MR3 (#498 (closed)) CSRF-scope review.

Plan: xref:plans/worker-portal-redesign-stage5-customize-my-dashboard.adoc — FU-56.