test(axum): preserve csrf fields

Cover the integration boundary for CSRF-style hidden fields: InteractionForm keeps arbitrary form fields available to app/auth extractors instead of dropping them during dispatch parsing.

req: auth/004

slhx-axum/tests/response.rs

@@ -72,6 +72,17 @@ fn interaction_form_requires_numeric_handle() {
     );
 }
 
+#[test]
+fn interaction_form_preserves_hidden_csrf_fields_for_extractors() {
+    // req: auth/004
+    let form = InteractionForm::parse_urlencoded(b"__h=42&csrf_token=abc123&title=Hello")
+        .unwrap();
+
+    assert_eq!(form.handle_id, 42);
+    assert_eq!(form.value("csrf_token"), Some("abc123"));
+    assert!(form.fields().iter().any(|(name, _)| name == "csrf_token"));
+}
+
 #[test]
 fn handler_registry_dispatches_by_numeric_handle_id() {
     let title = Slot::<String>::new(7);