Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/import_script.php

@@ -67,8 +67,9 @@
 //
 //   Accepted exposure: the browser can list any directory on the host.
 //       It returns directory names and .sh filenames only — no file contents, and nothing
-//       outside those two types. That is the minimum a file picker rooted at / can do, and it
-//       is guarded by the Unraid WebGUI session; see the CSRF note in README-unraid.md.
+//       outside those two types. That is the minimum a file picker rooted at / can do. browse
+//       is a GET read, so the WebGUI session is its whole boundary; the import itself is POST
+//       and is CSRF-guarded by Unraid's auto_prepend. See README-unraid.md.
 //
 // REQUEST
 //   GET  ?action=browse&path=/absolute/dir     list subdirectories and .sh files