Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/manual_sync.php

@@ -93,8 +93,9 @@
 //   output in /tmp indefinitely. /tmp is tmpfs, so an abandoned one clears at reboot anyway.
 //
 //   Accepted exposure: browse can list any directory on either host.
-//       Directory names only — no file contents, no file names. Guarded by the Unraid WebGUI
-//       session; see the CSRF note in README-unraid.md.
+//       Directory names only — no file contents, no file names. browse and poll are GET reads
+//       bounded by the WebGUI session; run and stop are POST and are CSRF-guarded by Unraid's
+//       auto_prepend before any code here runs. See README-unraid.md.
 //
 // REQUEST
 //   GET  ?action=hosts                             partners, Tailscale state, key presence