manager:latest appears to be missing an existing localhost agent CSRF fix

[ArshSSandhu]

Summary

During air-gapped Manager testing, the Manager agent was unable to complete its localhost check-in because the request was rejected with HTTP 403 csrf_invalid.

This localhost check-in issue has already been fixed in the repository, but the manager:latest image used during testing appeared to be missing the corresponding app-level CSRF change.

Observed Behavior

The Manager agent repeatedly failed with:

Check-in failed: HTTP 403

A direct localhost request to:

POST /api/v1/agents

also returned:

HTTP 403
Invalid CSRF token

The running image contained the localhost bypass in the agent route, but the equivalent bypass was not present in the app-level CSRF middleware.

Existing Fix

This behavior appears to already be addressed by commit:

fa9b6b241117a1be53d9bd957189f3a8a8778933

fix(create-a-container): let the localhost agent bootstrap check-in past the app-level CSRF guard

Expected Behavior

The published Manager image should contain the localhost agent CSRF fix from the source revision it is built from, allowing the local Manager agent to bootstrap successfully.

Next Step

Confirm which source revision was used to build the tested manager:latest image and whether the published image needs to be rebuilt or updated.

[ArshSSandhu]

@runleveldev

This looks like behavior that was already identified and fixed in source.

I opened this separately because the manager:latest image used during the air-gapped setup still reproduced the old behavior, so this may be an image/build synchronization issue rather than a new CSRF implementation bug.

Please let me know if you want me to verify the image revision and work on this.