Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/pages/arrs.php

@@ -435,7 +435,10 @@ setInterval(vvArrsLoad, 60000);
 function vvArrsRefreshRemote(host) {
   const btn = document.getElementById('vv-arr-rfsh-' + host);
   if (btn) { btn.disabled = true; btn.textContent = '↻…'; }
-  fetch(`/plugins/varaverk/api/arrs.php?action=refresh_remote&host=${host}&_=` + Date.now())
+  const fd = new FormData();
+  fd.append('action', 'refresh_remote');
+  fd.append('host', host);
+  fetch('/plugins/varaverk/api/arrs.php', { method: 'POST', body: fd })
     .then(r => r.json())
     .then(d => {
       if (btn) { btn.disabled = false; btn.textContent = d.ok ? '↻' : '✗'; }