fix: PUT /board/api/pages exempté CSRF + reload après saveTitle

- CSRF middleware: excluded_paths utilise maintenant startswith (pas exact match)
- /board/api/pages/* exempté — les PUT depuis page_editor passent
- saveTitle() reload la page après sauvegarde → sidebar mis à jour

app/middleware/csrf.py

@@ -16,11 +16,11 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     """
 
     SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback"}
+    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback", "/board/api/pages"}
 
     async def dispatch(self, request: Request, call_next):
-        # Webhook receiver and OAuth callback are exempt
+        # Webhook receiver, OAuth callback, and internal API are exempt
-        if request.url.path in self.EXCLUDED_PATHS:
+        if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS):
             return await call_next(request)
 
         if request.method in self.SAFE_METHODS:

app/templates/page_editor.html

@@ -155,7 +155,7 @@
         fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(newTitle)}`, {
           method: 'PUT',
           headers: { 'X-CSRF-Token': token }
-        });
+        }).then(() => { location.reload(); });
       },
       handleSlash(e) {
         if (e.key === '/' && !e.ctrlKey && !e.metaKey) {