feat(web): mutating actions with confirm gate, CSRF, audit (W6)

Adds the four destructive routes (vm.remove, vm.cleanup, cache.purge,
host.backup) plus a read-only /audit view, all behind require_user and
a synchronizer-token CSRF dependency (web/security.py). Every mutating
POST is a two-step confirm gate: a first POST always dry-runs the
underlying operations/ call and renders a confirm partial; only a
stage=execute POST performs the real action. Both stages write one
audit entry via operations/audit.py.

VM remove additionally validates that the target VMX resolves inside
config.paths.build_vms before touching anything (400 otherwise), and
vm.remove/vm.cleanup refuse to run (409) when a fresh vm-start.lock is
present, guarding against racing a live job.

SessionMiddleware is now installed unconditionally in create_app (was
previously only added when OIDC auth was active) since CSRF needs
request.session in both auth modes; the session secret stays
keyring-sourced when OIDC is active and falls back to a per-process
ephemeral secret in open mode. Adds python-multipart to the [web]
extra (required by FastAPI/Starlette form parsing, including plain
url-encoded forms, in the installed starlette version).

src/ci_orchestrator/web/templates/partials/host.html

@@ -37,3 +37,12 @@
   <p class="notice notice-warn">Runner status unavailable.</p>
   {% endif %}
 </section>
+
+<section class="card" id="backup-card">
+  <h2>Template backup</h2>
+  <form method="post" action="/host/backup" id="host-backup-form">
+    <input type="hidden" name="csrf" value="{{ csrf_token }}">
+    <label>Template: <input type="text" name="template" required></label>
+    <button type="submit" class="btn btn-danger">Backup template</button>
+  </form>
+</section>