Pac4jCsrfSupport

Reads Pac4j's session-managed CSRF token so a downstream handler can render it into a page (typically a <meta name="csrf-token"> tag consumed by HTMX or a form's hidden field).

Pac4j's DefaultMatchingChecker automatically wires CsrfTokenGeneratorMatcher into the matcher chain when the session has an active IndirectClient. That matcher stores the per-session token under Pac4jConstants.CSRF_TOKEN in the session. Handlers cannot easily retrieve it from the request because Http4sWebContext writes the token under a per-instance vault Key — so this implementation reads the shared SessionStore directly with a fresh WebContext built from the incoming request.

See docs/CSRF_GUIDE.md for the end-to-end wiring recipe.