Implement missing CSRF protection and periodic cleanup from README spec

[Copilot]

README documented CSRF protection and automatic recording cleanup as features, but neither were implemented. The README also referenced outdated Flask/SQLite stack when the codebase had migrated to FastAPI/PostgreSQL.

Changes

CSRF Protection (new vox/csrf.py)

• Signed tokens via itsdangerous tied to session ID
• Token passed to frontend via <meta name="csrf-token"> tag
• Frontend includes X-CSRF-Token header on all state-changing requests

// All POST/PUT/DELETE requests now include CSRF token
fetch('/user/set_user_info', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken },
    body: JSON.stringify({ name: userName, pronouns: userPronouns })
})

Periodic Cleanup (vox/fastapi_app.py)

• cleanup_old_recordings() existed but was never called
• Added background task on startup running every 24 hours
• Proper lifecycle management with shutdown cancellation

@app.on_event("startup")
async def startup_event():
    # ...
    app.state.cleanup_task = asyncio.create_task(periodic_cleanup())

@app.on_event("shutdown")
async def shutdown_event():
    if app.state.cleanup_task:
        app.state.cleanup_task.cancel()

README Corrections

• Flask/Gunicorn → FastAPI/Hypercorn
• SQLite → PostgreSQL/Supabase
• DeepSeek → Gemini 2.0 Flash
• Updated file references to match modular codebase structure
• Added vox/csrf.py to developer notes

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com//advisories
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Can we make sure everything in the readme in actually included and functional in the code?

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.