Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/auth.php

@@ -58,10 +58,12 @@
 //       authoring a fresh config — a config it created would carry no rules and a default
 //       policy, which is an accidental open door.
 //
-//   Known gap: no CSRF token is validated on the POST actions.
-//       The endpoint is guarded by the Unraid WebGUI session alone, and this is the highest-
-//       value endpoint in the plugin to reach — it can create a user and open a proxy host.
-//       Shared with the rest of the api layer; see the CSRF note in README-unraid.md.
+//   The POST actions are CSRF-guarded by the platform, not by this file.
+//       Unraid's auto_prepend (webGui/local_prepend.php) validates a token on every POST and
+//       terminates the request before any code here runs. That guard is the reason every
+//       mutating action lives in the POST arm — this is the highest-value endpoint in the
+//       plugin to reach, since it can create a user and open a proxy host. The five GET
+//       actions are reads and are deliberately outside it. See README-unraid.md.
 //
 // REQUEST
 //   GET  ?action=npm_proxies | npm_certs | lldap_users | lldap_groups | authelia_rules