feat: csrf tokens handling

api/paths/titles-id.yaml

@@ -1,5 +1,7 @@
 get:
   summary: Get title description
+  security:
+  - JwtAuthCookies: []
   operationId: getTitle
   parameters:
     - in: path

api/paths/users-id.yaml

@@ -28,12 +28,16 @@ get:
 
 patch:
   summary: Partially update a user account
+  security:
+  - JwtAuthCookies: []
   description: |
     Update selected user profile fields (excluding password). 
     Password updates must be done via the dedicated auth-service (`/auth/`).
     Fields not provided in the request body remain unchanged.
   operationId: updateUser
   parameters:
+    - $ref: '../parameters/access_token.yaml'  # ← для поля в UI и GoDoc
+    - $ref: '../parameters/xsrf_token_cookie.yaml'  # ← для CSRF
     - name: user_id
       in: path
       required: true