Mutation Request Origin & CSRF Context Guard

Start with README.md, then review SECURITY.md and INTEGRATION.md.

1. Run npm test; all 143 assertions must pass.
2. Copy src/index.js and optionally src/index.d.ts.
3. Configure exact allowed origins and connect a real host-owned CSRF-token verifier.
4. Test trusted proxy, origin, host, fetch-metadata, token, authentication, and authorization paths before production.
5. In Floot, finish by choosing Update or Publish so the reviewed integration becomes live.

This package never verifies a token, authenticates a user, authorizes a resource, sends a request, persists data, or performs a mutation.