sr-ht-compare-11d Give compare's CSRF guard a rendered deny handler instead of nil Lined Up

What is wrong: sourcehut-compare/web/router.go installs 'r.Use(csrf.Require(s.chromeSvc.SelfOrigin(), nil))'. Passing nil selects csrf.denyPlain, a bare text/plain http.Error. Every sibling — sourcehut-{tokens,bench,coverage,curator,specs,artifacts,dolt}/web/router.go — passes a renderer, e.g. 'func(w, r) { s.renderError(w, r, http.StatusForbidden, csrf.Message) }'. Status and message already agree with the siblings; only the presentation differs.

Why it matters: compare has no POST routes today, so nothing is refused yet — but the first form added gets a naked text/plain 403 on a surface whose every other refusal is a rendered page with nav. The router's own comment explains the guard exists 'because the day somebody adds the first POST is exactly the day nobody remembers to add the check'; the same argument applies to the renderer. csrf.Require's doc calls the nil default 'a usable default rather than an invitation to skip the middleware', and compare already has an error renderer (s.renderError) it simply isn't wiring in.

Correct variant: the seven siblings that pass a renderer, e.g. repo/path sourcehut-tokens/web/router.go::csrf.Require call site.

Fix: sourcehut-compare/web/router.go — replace the nil argument with 'func(w, r) { s.renderError(w, r, http.StatusForbidden, csrf.Message) }'.

Note: the register rates this consistency after two source reports disagreed (one called it cosmetic, one correctness-risk); both agree there are currently no POST routes so nothing is refused today.

Audit: D34 (cross-repo audit, 2026-08-17)