Add Dry Run button; fix CSRF token on all POST API calls

All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.

Plugin/usr/local/emhttp/plugins/varaverk/api/config.php

@@ -2,9 +2,8 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/config.php';
 
-$body    = json_decode(file_get_contents('php://input'), true);
-$file    = trim($body['file']    ?? '');
-$content = $body['content'] ?? '';
+$file    = trim($_POST['file']    ?? '');
+$content = $_POST['content'] ?? '';
 
 // Must be an allowed file for this host
 $allowed = vv_get_conf_files();