Enforce a centralized mutation-request policy

[karlg100]

Summary

• Add a central policy guard for state-changing Tiny File Manager requests.
• Require the expected HTTP method and CSRF token before mutation routes execute.
• Cover single and bulk copy, move, delete, upload, rename, archive, ACL, logout, and settings actions.
• Extend route-confinement tests to prove request-policy ordering.

Relationship to other PRs

Depends on the root-confinement pilot in #1434 and currently contains that complete branch history. Review the final mutation-policy commit as the incremental change until #1434 is resolved.

Validation

• git diff --check
• PHP 7.4 syntax check for every PHP file
• Central mutation-request checks: 125 passed
• HTTP route confinement: 58 passed
• Root-confinement static checks: 62 passed
• All inherited AFS, pilot, filesystem-confinement, and multi-device suites pass

Draft boundary

Tested on private cell. This PR should only be accetped after AFS-integration documented in #1434 are accepted.