fix: A19 terminé — plus aucun préfixe cookie-auth exempt du CSRF (v7.3.6)

- 46 appels non-GET équipés de `X-CSRF-Token` (expression cookie en ligne,
  portée indifférente) : agent_panel (9), settings (12), local_workspace (15),
  gitea_workspace (4), workspace (2), workspaces (5), library (2), welcome (2 en v7.3.5)
- 5 derniers préfixes sortis d'`EXCLUDED_PATHS` : /api/workspace (+/api/workspaces),
  /api/local-workspace, /api/settings, /api/gitea, /api/agent
- il ne reste exempté que : Bearer (/api/webhook, /api/v1, /api/v2, /scim/v2),
  callbacks /auth/*, pages publiques (/s/, /f/), /api/csrf-token et /api/frontend-error
- vérif : `node --check` des <script> des 39 templates → 0 échec (avant et après)
- tests : `anon_csrf()` sur les 5 tests d'anonymat devenus CSRF-first
- suite **1026/1026** · `ruff check app tests` OK

app/templates/workspaces.html

@@ -214,7 +214,7 @@ function workspacesPage() {
     },
 
     async selectLocal(ws) {
-      await fetch(`/api/workspaces/${ws.id}/select`, {method:'POST'});
+      await fetch(`/api/workspaces/${ws.id}/select`, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, method:'POST'});
       window.location = '/local-workspace';
     },
 
@@ -222,7 +222,7 @@ function workspacesPage() {
       if (!this.wsName.trim()) return;
       await fetch('/api/workspaces', {
         method:'POST',
-        headers:{'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
         body:JSON.stringify({name:this.wsName.trim()})
       });
       this.wsName = '';
@@ -240,7 +240,7 @@ function workspacesPage() {
       if (!this.wsName.trim()||!this.renameTarget) return;
       await fetch(`/api/workspaces/${this.renameTarget.id}`, {
         method:'PUT',
-        headers:{'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
         body:JSON.stringify({name:this.wsName.trim()})
       });
       this.wsName = '';
@@ -251,7 +251,7 @@ function workspacesPage() {
 
     async deleteWs(ws) {
       if (!confirm(`Delete workspace "${ws.name}" and all its pages?`)) return;
-      await fetch(`/api/workspaces/${ws.id}`, {method:'DELETE'});
+      await fetch(`/api/workspaces/${ws.id}`, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, method:'DELETE'});
       await this.load();
     },