Harden CSRF/CSP and add hash version upgrades

wwwroot/data/i18n/faq/en.md

@@ -209,6 +209,11 @@ Register again using the correct key from the host ‒ or leave it blank to crea
 Auth and admin-sensitive routes are rate-limited to reduce brute-force attempts.
 Wait briefly, then retry.
 
+### "CSRF validation failed."
+
+Authenticated write actions now require a same-origin browser request.
+Reload the page and retry. If you're calling the API from custom tooling, send matching `Origin`/`Referer` values for your app host.
+
 ## Data & Privacy
 
 -   Suggestions, votes, and phase states are stored in a shared database.