Deaktiver SvelteKit CSRF origin-sjekk for multi-subdomain

ORIGIN er hardkodet til ws.synops.no, men adm.synops.no trenger
også POST (auth callback). CSRF ivaretatt av OIDC PKCE+state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/svelte.config.js

@@ -3,7 +3,10 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter()
+		adapter: adapter(),
+		csrf: {
+			checkOrigin: false
+		}
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>