All fetch() POSTs now send application/x-www-form-urlencoded with the page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check. All PHP API handlers switched from php://input JSON to $_POST. Also adds Dry Run button (orange, between Run and Log) that sets DRY_RUN=1 in the script environment before executing.