Migrate CSRF, web templates, session cookies, and snapshot to mcdsl

CSRF: Replace local csrfProtect with mcdsl/csrf.Protect. Delete
internal/webserver/csrf.go.

Web: Replace renderTemplate with web.RenderTemplate + csrf.TemplateFunc.
Replace extractCookie with web.GetSessionToken. Replace manual session
cookie SetCookie with web.SetSessionCookie.

Snapshot: Replace local sqliteBackup with mcdsl/db.Snapshot.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/webserver/cert_detail_test.go

@@ -307,7 +307,7 @@ func newTestWebServer(t *testing.T, vault vaultBackend) *WebServer {
 		vault:    vault,
 		logger:   slog.Default(),
 		staticFS: staticFS,
-		csrf:     newCSRFProtect(),
+		csrf:     newTestCSRF(t),
 	}
 }