fix: PUT /board/api/pages exempté CSRF + reload après saveTitle

- CSRF middleware: excluded_paths utilise maintenant startswith (pas exact match)
- /board/api/pages/* exempté — les PUT depuis page_editor passent
- saveTitle() reload la page après sauvegarde → sidebar mis à jour

app/middleware/csrf.py

@@ -16,11 +16,11 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     """
 
     SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback"}
+    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback", "/board/api/pages"}
 
     async def dispatch(self, request: Request, call_next):
-        # Webhook receiver and OAuth callback are exempt
-        if request.url.path in self.EXCLUDED_PATHS:
+        # Webhook receiver, OAuth callback, and internal API are exempt
+        if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS):
             return await call_next(request)
 
         if request.method in self.SAFE_METHODS: