Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/api_test.php

@@ -59,8 +59,8 @@
 //       A key prefix, the cached API debug log, and the live schema are all visible to anyone
 //       with a WebGUI session. That is acceptable for a diagnostic reachable only by typing
 //       its URL, but it is the reason it is not linked from any page and should not be
-//       wrapped in one. See the CSRF note in README-unraid.md for the session-only guard this
-//       shares with the rest of the api layer.
+//       wrapped in one. It is a pure GET read, so Unraid's POST-only CSRF guard does not
+//       apply to it — the WebGUI session is its whole boundary. See README-unraid.md.
 //
 // REQUEST
 //   GET, no parameters