fix(backend): documente le 403 CSRF de require_trusted_origin

Le contrat OpenAPI et 31-contrat-authentification.md passaient sous
silence le 403 leve par require_trusted_origin sur refresh, logout,
logout-all et password. Ajoute REPONSE_ORIGINE_REFUSEE, regenere
openapi.json et etend test_openapi.py pour verifier que ces quatre
routes le declarent.

apps/backend/tests/api/test_openapi.py

@@ -15,6 +15,13 @@ METHODES = {"get", "post", "patch", "put", "delete"}
 # documenté y serait faux.
 SANS_REFUS = {("POST", "/api/v1/auth/logout")}
 
+ORIGINE_VERIFIEE = {
+    ("POST", "/api/v1/auth/refresh"),
+    ("POST", "/api/v1/auth/logout"),
+    ("POST", "/api/v1/auth/logout-all"),
+    ("POST", "/api/v1/auth/password"),
+}
+
 
 @pytest.fixture(scope="module")
 def schema() -> dict[str, Any]:
@@ -58,6 +65,16 @@ def test_every_administration_route_documents_the_role_refusal(schema: dict[str,
     assert sans_403 == []
 
 
+def test_every_origin_checked_route_documents_the_csrf_refusal(schema: dict[str, Any]) -> None:
+    sans_403 = [
+        (methode, chemin)
+        for methode, chemin, operation in operations(schema)
+        if (methode, chemin) in ORIGINE_VERIFIEE and "403" not in operation["responses"]
+    ]
+
+    assert sans_403 == []
+
+
 def test_the_validation_model_matches_what_the_handler_returns(schema: dict[str, Any]) -> None:
     modeles = {
         operation["responses"]["422"]["content"]["application/json"]["schema"]["$ref"]