Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/partnership_settings.php

@@ -43,7 +43,8 @@
 //   Credential fields are returned as they appear in the conf.
 //       The partnership sections carry SSH key paths and API keys, and this endpoint returns
 //       them for editing. That is the same exposure the raw conf editor has, over the same
-//       WebGUI session; see the CSRF note in README-unraid.md.
+//       WebGUI session. This is a GET read, so Unraid's POST-only CSRF guard does not apply —
+//       the session is its whole boundary. See README-unraid.md.
 //
 // REQUEST
 //   GET, no parameters