Carry the CSRF token on fetch requests and put mutations behind POST

Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.

Plugin/unraid/pages/setup.php

@@ -397,7 +397,7 @@ function vvPullMaster(btn) {
 function vvCreateKey(btn) {
   const status = document.getElementById('vv-key-status');
   btn.disabled = true; btn.textContent = '⟳ Creating…';
-  fetch('/plugins/varaverk/api/create_api_key.php?_=' + Date.now())
+  fetch('/plugins/varaverk/api/create_api_key.php', { method: 'POST' })
     .then(r => r.json()).then(d => {
       if (d.ok) {
         status.textContent = '✓ Key created — ' + d.key_preview;