fix(csrf): token valido quanto la sessione, errorhandler JSON per fetch (#12)

WTF_CSRF_TIME_LIMIT=None: la pagina di misura resta aperta ore, il token a
1h scadeva a metà turno. Aggiunto errorhandler(CSRFError) in app.py: risposte
JSON/fetch (Accept, Content-Type, X-Requested-With) ricevono 400 JSON con
csrf_expired, le altre un flash + redirect. Lato B1 (task_execute.html) resta
da gestire client-side, fuori da questo commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/config.py

@@ -20,7 +20,10 @@ class Config:
     SESSION_COOKIE_SAMESITE = "Lax"
     SESSION_COOKIE_SECURE = not DEBUG  # Only secure cookies in production (HTTPS)
     PERMANENT_SESSION_LIFETIME = 28800  # 8 hours
-    WTF_CSRF_TIME_LIMIT = 3600  # 1 hour
+    # None = token valid for the life of the session (#12): a measurement page
+    # stays open for hours between saves, and a 1h-expired token turned every
+    # late save into a silent "Errore di rete" for the operator.
+    WTF_CSRF_TIME_LIMIT = None
 
     # Station identity: each deployed client container sets this to the station
     # code it belongs to. Empty/None means "not configured".