fix: require serve token + loopback Host on API endpoints (M-15)

[jkyberneees]

Closes M-15.

Changes:

• Add requireServeToken and requireLocalHost middleware in cmd/odek/serve.go.
• Wrap every /api/* handler with token check, loopback Host validation, and existing local-Origin CSRF protection.
• Add validateServeTokenHTTP for HTTP requests (cookie + X-Odek-Ws-Token header).
• Update buildServeMux and buildServeMuxWithSessionByID test helpers to mirror production auth.
• Update existing E2E tests that hit API endpoints to supply the serve token.
• Update cmd/odek/ui/app.js to send X-Odek-Ws-Token on all API fetch calls.
• Add regression tests for missing token, foreign Host, valid header, and valid cookie.
• Update AGENTS.md and docs/SECURITY.md.

Tested with go test ./... -count=1.