Fix security issues from audit: gate partage fragments on share_active session, add CSRF to retry-email POST, remove dead App::verifyCsrf()

app/src/App.php

@@ -61,20 +61,6 @@ class App
         }
     }
 
-    /**
-     * Validate the CSRF token on a POST request.
-     * Halts with 403 if the token is missing or invalid.
-     */
-    public static function verifyCsrf(): void
-    {
-        if ($_SERVER['REQUEST_METHOD'] !== 'POST'
-            || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
-            || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
-            http_response_code(403);
-            exit('CSRF token invalide.');
-        }
-    }
-
     /**
      * Regenerate the CSRF token after a successful mutation.
      */