chore: clean up CSRF implementation

- Remove unused generateCsrfToken export from security.ts
  - Remove redundant /csrf-token path check (GET already exempt)
  - Restore defineConfig wrapper in vitest.config.ts for type safety

backend/vitest.config.ts

@@ -1,4 +1,6 @@
-export default {
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
   test: {
     globals: true,
     environment: "node",
@@ -18,4 +20,4 @@ export default {
       },
     },
   },
-};
+});