feat(config): web_auth_required ON implicit (login obligatoriu pe rutele web)

Inverseaza default-ul C12: rutele web cer sesiune + CSRF implicit (sigur pentru
prod). Dev rapid pe contul 1 = opt-out explicit AUTOPASS_WEB_AUTH_REQUIRED=false.
Testele de comportament import/dashboard marcate explicit dev-mode; test nou
blocheaza default-ul. 394 teste pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_dashboard.py

@@ -15,6 +15,9 @@ from fastapi.testclient import TestClient
 def client(monkeypatch):
     tmp = tempfile.mkdtemp()
     monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "t.db"))
+    # Comportament in mod dev (fallback cont 1, fara login/CSRF); auth web e
+    # default ON in prod — testat separat in test_web_*.
+    monkeypatch.setenv("AUTOPASS_WEB_AUTH_REQUIRED", "false")
     from app.config import get_settings
 
     get_settings.cache_clear()