[Perf][P4] Fix local-dev gaps: CSRF blocks POST /entities/search, mock-auth flag silently disabled

## Context

Two minor but real issues surfaced incidentally while running the `idp-v2-vs-app-referential-analysis.md` benchmark, both blocking proper local dev/load-testing.

## 1. CSRF blocks `POST /api/v1/entities/search` locally

While testing filtered search, `POST /api/v1/entities/search` returned HTTP 403 because Spring Security's default CSRF protection is active locally and not disabled anywhere in the codebase (including `MockSecurityConfiguration`). This didn't block the benchmark (a GET-based DSL filter endpoint `q=` was used instead as a workaround), but blocks proper load-testing of the richer POST-based search endpoint in local/dev/mock-auth profiles, and would affect any non-browser client (e.g. LLM-driven callers, scripts) that doesn't send CSRF tokens.

**Status as of the 2026-08-17 re-benchmark**: still unresolved — `POST /api/v1/entities/search` still returns 403 locally with mock auth enabled.

## 2. `app.security.mock-enabled` silently disabled by default in `application-local.yml`

During the 2026-08-17 re-benchmark, restarting IDP v2 from a fresh `main` checkout revealed that `application-local.yml` now has `app.security.mock-enabled: true` **commented out** (it was previously live/uncommented). Without passing it explicitly as a CLI override (`--app.security.mock-enabled=true`), every API call returns `401 Unauthorized` even when running with `--spring.profiles.active=local`.

This means the documented/expected local dev flow (`--spring.profiles.active=local` alone) no longer enables mock auth — a small but real local developer-experience regression that will confuse anyone following the existing local setup docs.

## Fix

1. Investigate and fix the CSRF configuration gap for `/api/v1/entities/search` in local/dev/mock-auth profiles (either exempt this path from CSRF when mock auth is active, or document/enforce the expected CSRF token flow for API clients).
2. Restore `app.security.mock-enabled: true` as active (uncommented) in `application-local.yml`, or update local setup documentation to reflect the new required override.

## Priority

P4 — minor, but low-effort and currently blocks convenient local load-testing and onboarding.

Start by reproducing POST /api/v1/entities/search with the local profile and mock auth, then inspect MockSecurityConfiguration and application-local.yml. Confirm the chosen CSRF behavior for local/mock-auth API clients and ensure the documented local command enables mock auth without a CLI override; verify both no longer produce 403 or 401.

Written by the indexing model from the issue text.