chore: clean up CSRF implementation

- Remove unused generateCsrfToken export from security.ts
  - Remove redundant /csrf-token path check (GET already exempt)
  - Restore defineConfig wrapper in vitest.config.ts for type safety

backend/src/index.ts

@@ -381,16 +381,12 @@ const csrfProtectionMiddleware = (
   next: express.NextFunction
 ) => {
   // Skip CSRF validation for safe methods (GET, HEAD, OPTIONS)
+  // Note: /csrf-token is a GET endpoint, so it's automatically exempt
   const safeMethods = ["GET", "HEAD", "OPTIONS"];
   if (safeMethods.includes(req.method)) {
     return next();
   }
 
-  // Skip CSRF for the CSRF token endpoint itself
-  if (req.path === "/csrf-token") {
-    return next();
-  }
-
   // Origin/Referer check for defense in depth
   const origin = req.headers["origin"];
   const referer = req.headers["referer"];

backend/src/security.ts

@@ -605,14 +605,7 @@ const signCsrfToken = (clientId: string, payload: CsrfTokenPayload): Buffer => {
 };
 
 /**
- * Generate a cryptographically secure CSRF token
- */
-export const generateCsrfToken = (): string => {
-  return crypto.randomBytes(CSRF_TOKEN_LENGTH).toString("hex");
-};
-
-/**
- * Create and store a new CSRF token for a client
+ * Create a new CSRF token for a client
  * Returns the token to be sent to the client
  */
 export const createCsrfToken = (clientId: string): string => {