fix(central-ui): resolve CentralUI-015..019 — pager windowing, logout CSRF, narrowed catch blocks, coverage; CentralUI-015 re-triaged Won't Fix

src/ScadaLink.CentralUI/Auth/AuthEndpoints.cs

@@ -124,17 +124,16 @@ public static class AuthEndpoints
             });
         }).DisableAntiforgery();
 
+        // Logout is a state-changing authenticated action (CentralUI-017): it
+        // keeps antiforgery validation enabled so it cannot be triggered
+        // cross-site. The NavMenu sign-out form includes the antiforgery token
+        // (rendered by the <AntiforgeryToken /> component). There is deliberately
+        // no GET /logout route — a state-changing GET is itself a CSRF vector
+        // (an <img src="/logout"> would forcibly log a user out).
         endpoints.MapPost("/auth/logout", async (HttpContext context) =>
         {
             await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
             context.Response.Redirect("/login");
-        }).DisableAntiforgery();
-
-        // GET /logout — allows direct navigation to logout (redirects to login after sign-out)
-        endpoints.MapGet("/logout", async (HttpContext context) =>
-        {
-            await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
-            return Results.Redirect("/login");
         });
 
         return endpoints;