Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/api/script.php

@@ -54,8 +54,9 @@
 //
 //   Accepted by design: this endpoint writes an executable root-run script from a browser.
 //       That is the entire feature, and it is why it is confined to a directory outside the
-//       repo with a flat namespace and a strict name pattern. It is guarded by the Unraid
-//       WebGUI session; see the CSRF note in README-unraid.md.
+//       repo with a flat namespace and a strict name pattern. The save and delete paths are
+//       POST, so Unraid's auto_prepend validates a CSRF token before any of this runs; the
+//       WebGUI session is the outer boundary. See README-unraid.md.
 //
 // REQUEST
 //   GET  ?id=Custom/<name>.sh                       read (empty content when absent)