refactor(ocr): CSRF-wrap injected fetchImpl too, not just the default

Mirror the useTranscriptionBlocks pattern: makeCsrfFetch(options.fetchImpl
?? fetch) wraps both the default and any injected fetch, so CSRF protection
holds regardless of how the hook is constructed — defense-in-depth against a
future caller injecting a bare fetch. Simplifies the CSRF test to assert on
the injected path instead of stubbing global fetch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/ocr/useOcrJob.svelte.test.ts

@@ -139,29 +139,26 @@ describe('createOcrJob.triggerOcr', () => {
 	});
 });
 
-describe('createOcrJob — CSRF on the default fetch path', () => {
+describe('createOcrJob — CSRF on mutating requests', () => {
 	afterEach(() => {
-		vi.unstubAllGlobals();
 		document.cookie = 'XSRF-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/';
 	});
 
-	it('injects X-XSRF-TOKEN on the trigger POST when no fetchImpl is provided', async () => {
+	it('injects X-XSRF-TOKEN on the trigger POST', async () => {
 		document.cookie = 'XSRF-TOKEN=tok-123; path=/';
-		const globalFetch = vi.fn(
-			async () =>
+		const fetchImpl = makeFetch({
+			'/ocr': () =>
 				new Response(JSON.stringify({ jobId: 'job-1' }), {
 					status: 200,
 					headers: { 'Content-Type': 'application/json' }
 				})
-		);
-		vi.stubGlobal('fetch', globalFetch);
+		});
 
-		// No fetchImpl — exercises the production default path used by the document page.
-		const job = createOcrJob({ documentId: () => 'doc-1' });
+		const job = createOcrJob({ documentId: () => 'doc-1', fetchImpl });
 		await job.triggerOcr('KURRENT', false);
 		job.destroy();
 
-		const postCall = globalFetch.mock.calls.find(
+		const postCall = fetchImpl.mock.calls.find(
 			([url, init]) =>
 				url.toString().includes('/ocr') && (init as RequestInit | undefined)?.method === 'POST'
 		);

frontend/src/lib/ocr/useOcrJob.svelte.ts

@@ -1,7 +1,7 @@
 import { m } from '$lib/paraglide/messages.js';
 import { getErrorMessage } from '$lib/shared/errors';
 import { translateOcrProgress } from '$lib/ocr/translateOcrProgress';
-import { csrfFetch } from '$lib/shared/cookies';
+import { makeCsrfFetch } from '$lib/shared/cookies';
 
 export interface OcrJobOptions {
 	documentId: () => string;
@@ -28,7 +28,7 @@ const DEFAULT_RESET_DELAY_MS = 1000;
 
 export function createOcrJob(options: OcrJobOptions): OcrJobController {
 	const { documentId, onJobFinished } = options;
-	const fetchImpl = options.fetchImpl ?? csrfFetch;
+	const fetchImpl = makeCsrfFetch(options.fetchImpl ?? fetch);
 	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 	const resetDelayMs = options.resetDelayMs ?? DEFAULT_RESET_DELAY_MS;