fix: notes save + all HTMX POST now send CSRF token

- base.html: inject CSRF token into HTMX hx-headers via inline script
- htmx:configRequest event updates CSRF on every request
- HTMX loaded synchronously (no defer) so config runs before body parsed
- Notes save now works, issue creation works, all POST protected

app/templates/base.html

@@ -5,11 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>FlowDeck</title>
   <link rel="stylesheet" href="/static/css/app.css">
-  <script src="https://unpkg.com/[email protected]" defer></script>
+  <script src="https://unpkg.com/[email protected]"></script>
   <script src="https://unpkg.com/[email protected]" defer></script>
   <script src="https://cdn.jsdelivr.net/npm/[email protected]/Sortable.min.js" defer></script>
 </head>
-<body>
+<body hx-headers='{"X-CSRF-Token":"__CSRF_PLACEHOLDER__"}'>
   <header class="app-header">
     <div class="header-left">
       <a href="/" class="logo">
@@ -46,6 +46,20 @@
     </div>
   </div>
 
+  <script>
+    // Inject CSRF token into HTMX headers before HTMX processes anything
+    (function() {
+      const getCsrf = () => {
+        const m = document.cookie.match(/csrf_token=([^;]+)/);
+        return m ? m[1] : '';
+      };
+      document.body.setAttribute('hx-headers', JSON.stringify({'X-CSRF-Token': getCsrf()}));
+      // Also update on every HTMX request
+      document.addEventListener('htmx:configRequest', function(evt) {
+        evt.detail.headers['X-CSRF-Token'] = getCsrf();
+      });
+    })();
+  </script>
   <script src="/static/js/app.js" defer></script>
   {% block scripts %}{% endblock %}
 </body>