feat(core): modern session/CSRF stack — NoopController, middleware, meta renderer, Bearer support

[ralflang]

Summary

Five small commits adding the server-side substrate for a standalone modern session/CSRF API the JS side can talk to without going through HordeCore/HordeMobile.

• Horde\Core\Controller\NoopController — generic 204 terminal handler for routes whose response is fully produced by middleware. Reusable for ping, csrf-refresh, readiness, future CORS preflight, etc.
• Horde\Core\Middleware\JwtSessionLoader — extended to also handle Authorization: Bearer access tokens (resolving refresh_jti claim) alongside its existing horde_jwt_refresh cookie path. Bearer wins on dual presence with an info log.
• Horde\Core\Middleware\CsrfRotationMiddleware — emits X-Csrf-Token response header bound to the request's HordeSession.
• Horde\Core\Middleware\SessionLifetimeMiddleware — touches _last_seen slot to refresh backend TTL, schedules regeneration when deadline past, emits X-Next-Ping + X-Session-Ts response headers.
• Horde\Core\PageOutput\SessionApiMetaRenderer — renders the bootstrap <meta name="session-api"> and <meta name="csrf-api"> tags from RegistryState + Token + the current request. Legacy Horde_PageOutput::outputMetaTags() now calls it before emitting accumulated tags so existing pages get the bootstrap automatically.

Strategy doc: horde-development/strategies/session-to-jwt/canonical-session-auth-csrf-strategy-2026-06-26.md §4.2.

Companion routes + JS client land in horde/base.