Add Dry Run button; fix CSRF token on all POST API calls

All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.

Plugin/usr/local/emhttp/plugins/varaverk/api/config.php

@@ -2,9 +2,8 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/config.php';
 
-$body    = json_decode(file_get_contents('php://input'), true);
-$file    = trim($body['file']    ?? '');
-$content = $body['content'] ?? '';
+$file    = trim($_POST['file']    ?? '');
+$content = $_POST['content'] ?? '';
 
 // Must be an allowed file for this host
 $allowed = vv_get_conf_files();

Plugin/usr/local/emhttp/plugins/varaverk/api/dryrun.php

@@ -0,0 +1,26 @@
+<?php
+header('Content-Type: application/json');
+require_once dirname(__DIR__) . '/include/scheduler.php';
+
+$id = trim($_POST['id'] ?? '');
+
+if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
+    echo json_encode(['ok' => false, 'error' => 'Invalid id']);
+    exit;
+}
+
+$script = SCRIPTS_DIR . '/' . $id;
+if (!file_exists($script)) {
+    echo json_encode(['ok' => false, 'error' => 'Script not found: ' . $id]);
+    exit;
+}
+
+$logFile = vv_job_log_path($id);
+$logDir  = dirname($logFile);
+if (!is_dir($logDir)) mkdir($logDir, 0755, true);
+
+file_put_contents($logFile, date('[Y-m-d H:i:s]') . " [DRY RUN] started\n", FILE_APPEND);
+
+exec('nohup env DRY_RUN=1 bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');
+
+echo json_encode(['ok' => true]);

Plugin/usr/local/emhttp/plugins/varaverk/api/log.php

@@ -2,7 +2,7 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/scheduler.php';
 
-$id = trim($_GET['id'] ?? '');
+$id = trim($_SERVER['REQUEST_METHOD'] === 'POST' ? ($_POST['id'] ?? '') : ($_GET['id'] ?? ''));
 
 if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
     echo json_encode(['ok' => false, 'error' => 'Invalid job id']);
@@ -11,7 +11,7 @@ if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id,
 
 $logFile = vv_job_log_path($id);
 
-if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_GET['clear'])) {
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['clear'])) {
     if (file_exists($logFile)) file_put_contents($logFile, '');
     echo json_encode(['ok' => true]);
     exit;

Plugin/usr/local/emhttp/plugins/varaverk/api/run.php

@@ -2,8 +2,7 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/scheduler.php';
 
-$body = json_decode(file_get_contents('php://input'), true);
-$id   = trim($body['id'] ?? '');
+$id = trim($_POST['id'] ?? '');
 
 if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
     echo json_encode(['ok' => false, 'error' => 'Invalid id']);
@@ -23,6 +22,6 @@ if (!is_dir($logDir)) mkdir($logDir, 0755, true);
 // Stamp the log so the panel shows when the run started
 file_put_contents($logFile, date('[Y-m-d H:i:s]') . " Manual run started\n", FILE_APPEND);
 
-exec('bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 &');
+exec('nohup bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');
 
 echo json_encode(['ok' => true]);

Plugin/usr/local/emhttp/plugins/varaverk/api/scheduler.php

@@ -2,10 +2,9 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/scheduler.php';
 
-$body = json_decode(file_get_contents('php://input'), true);
-$id      = trim($body['id']      ?? '');
-$enabled = (bool)($body['enabled'] ?? false);
-$cron    = trim($body['cron']    ?? '');
+$id      = trim($_POST['id']      ?? '');
+$enabled = (bool)($_POST['enabled'] ?? false);
+$cron    = trim($_POST['cron']    ?? '');
 
 if (!$id) {
     echo json_encode(['ok' => false, 'error' => 'Missing id']);

Plugin/usr/local/emhttp/plugins/varaverk/api/settings.php

@@ -1,8 +1,7 @@
 <?php
 header('Content-Type: application/json');
 
-$body      = json_decode(file_get_contents('php://input'), true);
-$scriptsDir = trim($body['scripts_dir'] ?? '');
+$scriptsDir = trim($_POST['scripts_dir'] ?? '');
 
 if (!$scriptsDir) {
     echo json_encode(['ok' => false, 'error' => 'scripts_dir is required']);