Add Dry Run button; fix CSRF token on all POST API calls

All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.

Plugin/usr/local/emhttp/plugins/varaverk/api/log.php

@@ -2,7 +2,7 @@
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/scheduler.php';
 
-$id = trim($_GET['id'] ?? '');
+$id = trim($_SERVER['REQUEST_METHOD'] === 'POST' ? ($_POST['id'] ?? '') : ($_GET['id'] ?? ''));
 
 if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
     echo json_encode(['ok' => false, 'error' => 'Invalid job id']);
@@ -11,7 +11,7 @@ if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id,
 
 $logFile = vv_job_log_path($id);
 
-if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_GET['clear'])) {
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['clear'])) {
     if (file_exists($logFile)) file_put_contents($logFile, '');
     echo json_encode(['ok' => true]);
     exit;