If you are using something like token auth (you mentioned JWT), then you are not using cookies, at which point CSRF is not needed. This is because the user's browser isn't automatically sending the cooking containing a session ID on every request to the server.
That said, you can implement session auth with DRF REST APIs, which accept a session cookie on requests. For this, I believe you would receive/send CSRF tokens via HTTP headers.
XSS is not something you would worry too much about in an API endpoint. It is something you should worry a lot about in your client side SPA though. If using something like React, your templates will be auto-escaped, and thus you have to go out of your way to make it a problem.
A lot of the advice I see now is about http-only cookies but I think I'd probably look more into oAuth in the future.
Vim for super quick changes (I’d like to increase my proficiency with vim but not really done much to do so).
Vscode for light text editing : coding which doesn’t require me to dig in to debug for a major length of time.
Jetbrains IDE for real work / tinkering were I may need to debug / leverage breakpoints / have good autocomplete.