Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/pages/partnership.php

@@ -202,7 +202,7 @@ function vvApiKey(btn) {
   const origText = btn.textContent;
   btn.disabled = true;
   btn.textContent = '⟳ Working…';
-  fetch('/plugins/varaverk/api/create_api_key.php?_=' + Date.now())
+  fetch('/plugins/varaverk/api/create_api_key.php', { method: 'POST' })
     .then(r => {
       if (!r.ok || r.status === 0) throw new Error('HTTP ' + r.status + ' ' + r.statusText);
       return r.text();