fix

apps/api/internal/httpapi/csrf_test.go

@@ -62,6 +62,14 @@ func TestCSRFAllowsSafeMethodsWithoutHeader(t *testing.T) {
 	if !found {
 		t.Fatal("expected non-HttpOnly CSRF cookie on first GET")
 	}
+	hdr := rec.Header().Get("X-CSRF-Token")
+	if hdr == "" {
+		t.Fatal("expected X-CSRF-Token response header on GET (cross-origin SPA seed)")
+	}
+	cookie := findCSRFCookie(rec.Result().Cookies())
+	if cookie == nil || cookie.Value != hdr {
+		t.Fatalf("X-CSRF-Token header %q must match cookie value", hdr)
+	}
 }
 
 func TestCSRFRejectsPOSTWithoutToken(t *testing.T) {