harden browser routes with csrf checks and lock internal/dev endpoints

.env.example

@@ -3,6 +3,8 @@ NODE_ENV=production
 PORT=3000
 LOG_LEVEL=info
 APP_BASE_URL=https://xartaudio.example.com
+ENABLE_DEV_ROUTES=false
+ALLOW_IN_MEMORY_STATE_FALLBACK=false
 
 # Better Auth
 BETTER_AUTH_SECRET=replace-me