removed kanban from gitignore

kanban/tasks/014-add-csrf-protection-to-word-input-form.md

@@ -0,0 +1,17 @@
+---
+id: 14
+title: Add CSRF protection to word-input form
+status: done
+priority: medium
+created: 2026-07-17T03:57:20.699057952+02:00
+updated: 2026-07-19T21:23:27.817959707+02:00
+started: 2026-07-19T21:23:27.819406405+02:00
+completed: 2026-07-19T21:23:27.819406405+02:00
+tags:
+    - security
+claimed_by: rain-raven
+claimed_at: 2026-07-19T21:23:27.817959707+02:00
+class: standard
+---
+
+From framework review (docs/framework_review.md), P1-2. tpl/index.tpl POSTs to mode=display which writes session state and triggers image downloads. No CSRF token means a cross-site request can drive the machine. Fix: add session-bound CSRF token to the form, validate in ZAPDisplay.