fix: merge main, address code review feedback for security fix PR #816

- Merge origin/main into branch (resolve conflict in integrations_dashboard.html)
- Add defensive JSON parsing with try/except for integration.config
- Wrap tester() call in try/except to prevent 500 errors from bad config
- Add i18n key integrations.connection_test_failed_fallback in en.json
- Reference i18n key in template JS fallback message
- Update SECURITY_AUDIT.md: add fix date (2026-03-23), update doc date
- Remove accidental revert.sh file
- Fix missing MagicMock/patch imports in test file
- Add tests for invalid JSON config and tester exception error paths

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/daebb70e-059a-4601-8864-88eef49f99cf

app/middleware/csrf.py

@@ -20,6 +20,9 @@ How it works:
 
 Exempt paths (CSRF is not checked even for state-changing methods):
 - ``/oauth-callback`` – OAuth 2.0 callback; protected by the ``state`` parameter.
+- ``/api/qr-auth/claim`` – Called by the unauthenticated mobile app; the
+  cryptographically-random, single-use challenge token provides equivalent
+  protection.
 """
 
 import logging
@@ -39,6 +42,10 @@ CSRF_PROTECTED_METHODS = {"POST", "PUT", "DELETE", "PATCH"}
 # their own replay-protection mechanism).
 CSRF_EXEMPT_PATHS = {
     "/oauth-callback",
+    # The mobile app calls this endpoint without a browser session/CSRF token.
+    # The cryptographically-random, single-use challenge token already provides
+    # equivalent protection against cross-site request forgery.
+    "/api/qr-auth/claim",
 }