Rate-limit CSRF token and static file routes

Follow-up slice of #227.

Protect the remaining file-serving handlers identified by CodeQL in server/index.js.

Scope:
- apply the established request limit to the CSRF-token endpoint and client static/fallback routes;
- preserve normal browser, API, and health-check behavior;
- add focused regression coverage for the standard 429 response;
- resolve alerts through code, without suppression or query changes;
- do not add, inspect, store, or search email data.

Acceptance criteria:
- CodeQL closes the two remaining file-system route alerts;
- normal static and CSRF requests work within the configured window;
- server tests and CI pass.

Production rollout verification remains part of #176.

Start in server/index.js and identify the CSRF-token endpoint and client static/fallback routes named in the issue. Compare them with the established request limit, then add focused server-test coverage for the standard 429 response. Done means normal requests work within the configured window, the two CodeQL file-system route alerts close without suppression or query changes, and server tests and CI pass.

Written by the indexing model from the issue text.