Fix CSRF vulnerability (GHSA-mp2f-3fq8-r9vj) on /me endpoints

• Adds a csrfProtectForm dual-mode helper (form/cookie vs. JSON/bearer-token) for /api/me/self
• Adds CSRFField to /me/import and /me/invites
• Fixes two additional bugs:
  • The _gorilla_csrf cookie had no explicit Path, so it defaulted to the issuing page's directory (/me/) and wasn't sent to /api/... routes. Added csrf.Path("/") everywhere csrf.Protect is used (including the pre-existing /me/delete and /reset routes, for consistency).
  • The hidden CSRF field broke gorilla/schema's strict form decoding for updateSettings. Now we set IgnoreUnknownKeys(true) on the shared form decoder.