fix: bootstrap admin CSRF tokens

src/lib/foundation/security.ts

@@ -139,6 +139,16 @@ function trySetCsrfCookie(
 	}
 }
 
+/** Read-only access for Server Components, which cannot write response cookies. */
+export async function readCsrfCookieToken(): Promise<string> {
+	try {
+		return readExistingCsrfCookie(await cookies()) ?? "";
+	} catch {
+		logger.warn("Failed to read CSRF cookie");
+		return "";
+	}
+}
+
 /** Sets the CSRF cookie when possible; returns token or empty string (never throws). */
 export async function setCsrfCookie(): Promise<string> {
 	try {