All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.
Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.