CVE-2026-47725: nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

Every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect:

• top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs)
• same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover)
• the GET /ui/logout route, which a third-party <img src=".../ui/logout"> can force-trigger

The admin UI signs CA certificates, mints API keys, rotates / retires / deletes CAs, disables operators, and changes server settings. CSRF here is a real privilege escalation, not just annoyance.