accounts.py: 8/8 mutation endpoints CSRF-protected
campaigns.py: validate-step now CSRF-protected
9
async def validate_step(payload: dict, db: AsyncSession = Depends(get_db),
                        user: User = Depends(get_current_user),
                        _: None = Depends(require_csrf)):
    """Wizard step validation between steps (step 3, 6, 9, 11 checks)."""