fix: attach CSRF token to state-changing requests

frontend/src/MvpPanel.vue

@@ -6,6 +6,7 @@ import interactionPlugin from '@fullcalendar/interaction'
 import type { CalendarOptions, EventDropArg } from '@fullcalendar/core'
 import { Activity, ArchiveRestore, Download, FileJson, LogOut, Plus, RefreshCw, Trash2, Upload } from 'lucide-vue-next'
 import { dateKey, habitWeek, mergePage, moveDueDate } from './lib/mvp-utils'
+import { csrfHeader } from './lib/csrf'
 
 type View = 'calendar'|'habits'|'settings'
 type Task = { id:string; title:string; due_at:string|null; version:number }
@@ -21,6 +22,8 @@ const week = computed(() => habitWeek())
 async function request(path:string, options:RequestInit={}) {
   const headers:Record<string,string> = { ...(options.headers as Record<string,string> || {}) }
   if (options.body && !(options.body instanceof FormData)) headers['Content-Type']='application/json'
+  const csrf = csrfHeader(options.method)
+  if (csrf['x-csrf-token']) headers['x-csrf-token'] = csrf['x-csrf-token']
   const response = await fetch('/api/v1'+path,{ credentials:'include',...options,headers })
   if (!response.ok) throw new Error((await response.json().catch(()=>({}))).detail || `请求失败 (${response.status})`)
   const type=response.headers.get('content-type')||''