fix: context menu implémenté + page editor CSRF + workspace context

- Context menu: toutes les actions fonctionnelles (favorite, copyLink, duplicate, rename, move, delete, openTab)
- Page editor: CSRF token ajouté dans save() et saveTitle()
- Page editor: workspace context restauré (owner/repo extrait de pages.workspace)
- Route /pages/{id}: utilise board._sidebar_data pour préserver le contexte projet

app/templates/page_editor.html

@@ -136,7 +136,12 @@
       save() {
         this.saving = true;
         const title = document.querySelector('.page-title h1')?.textContent || 'New page';
-        fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(title)}&content=${encodeURIComponent(this.content)}`, { method: 'PUT' })
+        const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+        const token = csrf ? csrf[1] : '';
+        fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(title)}&content=${encodeURIComponent(this.content)}`, {
+          method: 'PUT',
+          headers: { 'X-CSRF-Token': token }
+        })
           .then(() => {
             this.saved = true;
             this.dirty = false;
@@ -145,7 +150,12 @@
           });
       },
       saveTitle(newTitle) {
-        fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(newTitle)}`, { method: 'PUT' });
+        const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+        const token = csrf ? csrf[1] : '';
+        fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(newTitle)}`, {
+          method: 'PUT',
+          headers: { 'X-CSRF-Token': token }
+        });
       },
       handleSlash(e) {
         if (e.key === '/' && !e.ctrlKey && !e.metaKey) {