fix: attach CSRF token to state-changing requests

frontend/src/App.vue

@@ -6,6 +6,7 @@ import {
   Settings, Trash2, X, CalendarRange, Repeat2,
 } from 'lucide-vue-next'
 import { filterTasks, fromDateTimeLocal, groupTaskTree, renderMarkdown, toDateTimeLocal } from './lib/task-utils'
+import { csrfHeader } from './lib/csrf'
 import MvpPanel from './MvpPanel.vue'
 
 type FolderItem = { id: string; name: string }
@@ -77,9 +78,15 @@ watch(showCompleted, () => {
 })
 
 async function api(path: string, options: RequestInit = {}) {
+  const headers = new Headers(options.headers || {})
+  if (!headers.has('Content-Type') && options.body && !(options.body instanceof FormData)) {
+    headers.set('Content-Type', 'application/json')
+  }
+  const csrf = csrfHeader(options.method)
+  if (csrf['x-csrf-token']) headers.set('x-csrf-token', csrf['x-csrf-token'])
   const response = await fetch('/api/v1' + path, {
     credentials: 'include',
-    headers: { 'Content-Type': 'application/json', ...(options.headers || {}) },
+    headers,
     ...options,
   })
   if (!response.ok) {