[Frontend] Add CSRF defenses for cookie-authenticated state changes

## Problem

Secure cookies require explicit protection for profile, wallet, GDPR, notification, and admin mutations.

## Relevant code

`src/lib/api, src/pages/api`

## Proposed scope

Validate Origin and CSRF tokens where appropriate and test cross-site form and fetch attempts.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start from the latest main branch and inspect the API entry points under src/lib/api and src/pages/api. First characterize the reported cross-site form and fetch behavior with a focused automated test, then cover the listed cookie-authenticated mutations and related success, failure, and boundary cases. Done means the proposed defenses are implemented without weakening authorization, privacy, error handling, TypeScript, or lint, with regression tests and documentation updates where needed.

Written by the indexing model from the issue text.