Fix CSRF token missing in submission and login forms

Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)

Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.

Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/templates/auth/login.html

@@ -6,6 +6,8 @@
 <h1>Login</h1>
 
 <form method="POST">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+
     <div class="form-group">
         <label for="username">Username</label>
         <input type="text" id="username" name="username" required autofocus>
@@ -20,6 +22,6 @@
 </form>
 
 <p style="margin-top: 20px;">
-    <a href="{{ url_for('submission.form') }}">Return to feedback submission</a>
+    <a href="{{ url_for('index') }}">Return to home page</a>
 </p>
 {% endblock %}

app/templates/submission/form.html

@@ -9,6 +9,8 @@
 <p>We value your feedback. Please share your thoughts, report issues, or suggest improvements below.</p>
 
 <form method="POST" enctype="multipart/form-data">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+
     <div class="form-group">
         <label for="feedback_text">Your Feedback</label>
         <textarea id="feedback_text" name="feedback_text"