fix: sidebar Favorites + Shared, Library page with tabs, CSRF fix

- Section Favorites ajoutée dans le sidebar (⭐)
- Section Shared ajoutée (👥)
- Section Library remplacée par bouton 📚 qui ouvre /library
- Page /library avec onglets: Recents | Favorites | Shared | Private
- CSRF token injecté dans les appels fetch (newPage, newSubPage)
- Bouton + sur éléments sidebar corrigé (POST /board/api/pages avec X-CSRF-Token)
- Bouton 📚 sur sections ouvre /library
- sidebar_data inclut favorite_pages=[]

app/templates/base.html

@@ -120,21 +120,59 @@
       </ul>
     </div>
 
-    <!-- Library -->
+    <!-- Favorites -->
     <div class="sidebar-section">
       <div class="sidebar-section-header">
         <div class="sidebar-section-title">
-          <span class="chevron open">▶</span> Library
+          <span class="chevron open">▶</span> Favorites
+        </div>
+        <div class="sidebar-section-actions">
+          <button class="section-action-btn" title="Add page" @click="newPage('Favorites')">+</button>
         </div>
       </div>
       <ul class="sidebar-items">
-        <li class="sidebar-item"><span class="page-icon">✅</span><span class="page-name">My Tasks</span></li>
-        <li class="sidebar-item"><span class="page-icon">🛒</span><span class="page-name">Marketplace</span></li>
-        <li class="sidebar-item"><span class="page-icon">❓</span><span class="page-name">Help</span></li>
-        <li class="sidebar-item"><span class="page-icon">🗑️</span><span class="page-name">Trash</span></li>
+        {% for page in favorite_pages %}
+        <li class="sidebar-item {% if page.active %}active{% endif %}"
+            @click="navigateTo('{{ page.url }}')"
+            @contextmenu.prevent="showContextMenu($event, '{{ page.id }}', '{{ page.name }}')">
+          <span class="page-icon">{{ page.icon }}</span>
+          <span class="page-name">{{ page.name }}</span>
+          <span class="item-actions">
+            <button class="item-action-btn" @click.stop="newSubPage('{{ page.id }}')">+</button>
+          </span>
+        </li>
+        {% endfor %}
+        {% if not favorite_pages %}
+        <li class="sidebar-item">
+          <span class="page-icon">⭐</span>
+          <span class="page-name text-dim">No favorites yet</span>
+        </li>
+        {% endif %}
       </ul>
     </div>
 
+    <!-- Shared -->
+    <div class="sidebar-section">
+      <div class="sidebar-section-header">
+        <div class="sidebar-section-title">
+          <span class="chevron">▶</span> Shared
+        </div>
+      </div>
+      <ul class="sidebar-items">
+        <li class="sidebar-item">
+          <span class="page-icon">👥</span>
+          <span class="page-name text-dim">No shared pages</span>
+        </li>
+      </ul>
+    </div>
+
+    <!-- Library button -->
+    <div class="sidebar-nav" style="margin-top: 8px;">
+      <a href="/library" class="sidebar-nav-item" @click.prevent="navigateTo('/library')">
+        <span class="nav-icon">📚</span> Library
+      </a>
+    </div>
+
     <!-- Footer -->
     <div class="sidebar-footer">
       <div class="sidebar-invite" x-show="showInvite" x-transition>
@@ -326,23 +364,33 @@
       },
 
       openLibrary(id) {
-        // Open the library view for this section/page
-        console.log('Open library for:', id);
-        window.location.href = '/pages/' + id.replace('page/', '');
+        window.location.href = '/library';
       },
       openInLibrary(id) { this.openLibrary(id); },
       showMore(id) { console.log('Show more:', id); },
       addPage(section) { this.newPage(section); },
       addSubPage(id) { this.newSubPage(id); },
+      getCsrfToken() {
+        const m = document.cookie.match(/csrf_token=([^;]+)/);
+        return m ? m[1] : '';
+      },
       newPage(section) {
-        fetch(`/board/api/pages?title=New%20page&section=${encodeURIComponent(section)}`, { method: 'POST' })
-          .then(r => r.json())
-          .then(data => { window.location.href = `/pages/${data.id}`; });
+        fetch(`/board/api/pages?title=New%20page&section=${encodeURIComponent(section)}`, {
+          method: 'POST',
+          headers: { 'X-CSRF-Token': this.getCsrfToken() }
+        })
+          .then(r => { if (!r.ok) throw new Error('CSRF or API error'); return r.json(); })
+          .then(data => { window.location.href = `/pages/${data.id}`; })
+          .catch(err => { alert('Failed to create page: ' + err.message); });
       },
       newSubPage(parentId) {
-        fetch(`/board/api/pages?title=New%20sub-page&section=Private`, { method: 'POST' })
-          .then(r => r.json())
-          .then(data => { window.location.href = `/pages/${data.id}`; });
+        fetch(`/board/api/pages?title=New%20page&section=Private`, {
+          method: 'POST',
+          headers: { 'X-CSRF-Token': this.getCsrfToken() }
+        })
+          .then(r => { if (!r.ok) throw new Error('CSRF or API error'); return r.json(); })
+          .then(data => { window.location.href = `/pages/${data.id}`; })
+          .catch(err => { alert('Failed to create sub-page: ' + err.message); });
       },
 
       toggleTheme() {