fix(ui): guard against nil session in CSRF middleware

The CSRF middleware assumes a session is always present in the request
context, but the web session middleware skips session creation for
static-asset routes (/js/*, /stylesheets/*, /icon/*, etc.).

A POST request to any static path causes a nil-pointer panic when
calling .CSRF() on the nil session.

Add a nil check to return 400 Bad Request when no session is present.

internal/ui/csrf_middleware.go

@@ -39,7 +39,13 @@ func (m *csrfMiddleware) handle(next http.Handler) http.Handler {
 }
 
 func (m *csrfMiddleware) validate(w http.ResponseWriter, r *http.Request) bool {
-	csrfToken := request.WebSession(r).CSRF()
+	session := request.WebSession(r)
+	if session == nil {
+		response.HTMLBadRequest(w, r, errors.New("invalid or missing CSRF"))
+		return false
+	}
+
+	csrfToken := session.CSRF()
 	formValue := r.FormValue("csrf")
 	headerValue := r.Header.Get("X-Csrf-Token")