Heimdall completion route: no antiforgery opt-out (the form is read by hand); pin a malformed form body

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Bifrost.Web/Program.cs

@@ -550,7 +550,7 @@ app.MapPost("/auth/heimdall/complete", async (
 
         return Results.Redirect(HeimdallAuthService.ErrorRedirect);
     }
-}).AllowAnonymous().DisableAntiforgery();
+}).AllowAnonymous();
 
 app.MapPost("/auth/sign-out", async (HttpContext httpContext) =>
 {

tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs

@@ -679,6 +679,10 @@ public sealed class HeimdallCompletionTests
             "/auth/heimdall/complete",
             new StringContent("{\"attempt\":\"x\"}", Encoding.UTF8, "application/json"));
         results.Add(("json body", new CompletionResult(json, false), "Heimdall completion has no attempt for this browser."));
+        using var malformed = await client.PostAsync(
+            "/auth/heimdall/complete",
+            new StringContent("not a multipart body", Encoding.UTF8, "multipart/form-data"));
+        results.Add(("malformed form", new CompletionResult(malformed, false), "Heimdall completion has no attempt for this browser."));
 
         foreach (var (name, result, reason) in results)
         {