Harden axum response and root fingerprint tests with scraper-based HTML parsing instead of raw rendered-string equality. req: test/005
Cover the integration boundary for CSRF-style hidden fields: InteractionForm keeps arbitrary form fields available to app/auth extractors instead of dropping them during dispatch parsing. req: auth/004