fix: CSRF token manquant dans les fetch() POST du board et card detail

- board.html: ajout X-CSRF-Token header sur fetch /api/move et /api/issues
- card_detail.html: ajout helper getCsrf() + header sur tous les fetch POST/PATCH
- Sans ce fix, drag & drop, création issue, checklists échouent en production

app/templates/card_detail.html

@@ -99,6 +99,12 @@
 </div>
 
 <script>
+  // ponytail: CSRF helper
+  function getCsrf() {
+    const m = document.cookie.match(/csrf_token=([^;]+)/);
+    return m ? m[1] : '';
+  }
+
   function cardDetail() {
     return {
       updateField(field, value) {
@@ -109,18 +115,27 @@
         console.log('Toggle status');
       },
       toggleChecklistItem(id, checked) {
-        fetch(`/api/checklist-items/${id}?checked=${checked}`, { method: 'PATCH' });
+        fetch(`/api/checklist-items/${id}?checked=${checked}`, {
+          method: 'PATCH',
+          headers: { 'X-CSRF-Token': getCsrf() }
+        });
       },
       addChecklistItem(clId) {
         const content = prompt('Item name:');
         if (content) {
-          fetch(`/api/checklist-items/${owner}/${repo}/${issue_id}/${clId}?content=${encodeURIComponent(content)}`, { method: 'POST' })
+          fetch(`/api/checklist-items/${owner}/${repo}/${issue_id}/${clId}?content=${encodeURIComponent(content)}`, {
+            method: 'POST',
+            headers: { 'X-CSRF-Token': getCsrf() }
+          })
             .then(() => htmx.ajax('GET', `/api/issues/${owner}/${repo}/${issue_id}?format=html`, { target: '#card-modal-content', swap: 'innerHTML' }));
         }
       },
       addChecklist() {
         const title = prompt('Checklist name:') || 'Checklist';
-        fetch(`/api/checklists/${owner}/${repo}/${issue_id}?title=${encodeURIComponent(title)}`, { method: 'POST' })
+        fetch(`/api/checklists/${owner}/${repo}/${issue_id}?title=${encodeURIComponent(title)}`, {
+          method: 'POST',
+          headers: { 'X-CSRF-Token': getCsrf() }
+        })
           .then(() => htmx.ajax('GET', `/api/issues/${owner}/${repo}/${issue_id}?format=html`, { target: '#card-modal-content', swap: 'innerHTML' }));
       },
       addComment(body) {