@router.post("/create")
async def create_campaign(payload: CampaignIn, db: AsyncSession = Depends(get_db),
                          user: User = Depends(get_current_user),
                          _: None = Depends(require_csrf)):
    """Create a new campaign (wizard step 12 / Save). Validates all references."""
    errors = await _validate_refs(db, user, payload)
    if errors:
        raise HTTPException(status_code=400, detail={"message": "Validation failed",
                                                     "errors": errors})
    c = Campaign(user_id=user.id, **payload.model_dump())
    db.add(c)
===
69:        r = api.post("/auth/logout", headers={"X-CSRF-Token": ""})
73:        r = api.post("/auth/logout", headers={"X-CSRF-Token": "forged-token"})
232:        r = api.post("/recipients/import", data={"list_id": "1"}, files=files, cookies={})