Log entry into the AI endpoint before any dependency loads

A POST the browser demonstrably sent — correct token, correct body — left no
trace: no CSRF termination, no fatal, and no action log. Rejected-before-PHP
and died-inside-the-include are indistinguishable from outside, so the first
statement now records that execution arrived.

Plugin/unraid/api/ai.php

@@ -73,6 +73,16 @@
 //   include/ai.php            vv_ai_stats(), vv_ai_config(), vv_ai_job_*()
 //   Tools/ai_chat_worker.php  the detached worker
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
+// First executable statement, deliberately dependency-free. A request that is rejected by the
+// CSRF prepend never reaches here and a request that dies inside the include never reaches the
+// action log below, and those two look identical from outside — which is what made a POST that
+// the browser demonstrably sent leave no trace anywhere on the server.
+@file_put_contents('/var/log/varaverk/ai.log',
+    date('Y-m-d H:i:s') . ' ENTER ' . ($_SERVER['REQUEST_METHOD'] ?? '?')
+    . ' ' . ($_SERVER['REQUEST_URI'] ?? '?')
+    . ' ct=' . substr($_SERVER['CONTENT_TYPE'] ?? '-', 0, 40)
+    . ' len=' . ($_SERVER['CONTENT_LENGTH'] ?? '-') . "\n", FILE_APPEND | LOCK_EX);
+
 header('Content-Type: application/json');
 header('Cache-Control: no-store, no-cache');
 require_once dirname(__DIR__) . '/include/ai.php';