fix: 公开接口豁免 CSRF 校验

/api/public/ 命名空间下的匿名 PUT/POST 请求没有会话 cookie，
被 CSRF 中间件拦在 403。auth 中间件已放行该前缀，CSRF 这里补齐豁免，
让公开定时任务页的编辑保存能正常调用。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

offline-backend-20260512/backend/app/gateway/csrf_middleware.py

@@ -37,9 +37,17 @@ def should_check_csrf(request: Request) -> bool:
     if request.method not in ("POST", "PUT", "DELETE", "PATCH"):
         return False
 
-    path = request.url.path.rstrip("/")
+    path = request.url.path
+    stripped = path.rstrip("/")
     # Exempt /api/v1/auth/me endpoint
-    if path == "/api/v1/auth/me":
+    if stripped == "/api/v1/auth/me":
+        return False
+    # Anonymous public endpoints (mirror auth_middleware._PUBLIC_PATH_PREFIXES).
+    # These intentionally have no cookie session, so the Double-Submit Cookie
+    # pattern is both impossible (no token to compare) and unnecessary (no
+    # session for an attacker to ride). Without this exemption every public
+    # PUT/POST returns 403 even though auth was bypassed earlier in the chain.
+    if path.startswith("/api/public/"):
         return False
     return True