- base.html: inject CSRF token into HTMX hx-headers via inline script
- htmx:configRequest event updates CSRF on every request
- HTMX loaded synchronously (no defer) so config runs before body parsed
- Notes save now works, issue creation works, all POST protected
1. Refresh button no longer doubles header
- Added ?fragment=1 param to filter/refresh HTMX requests
- Board route returns board_fragment.html (columns only) for fragment requests
- Refresh button uses window.location.reload() for full page reload
2. No more raw JSON in header
- base.html: user info rendered server-side via template variable
- board.py: decodes session cookie, passes user to template
- Dashboard/board templates show Login/Deconnexion based on auth state
3. New issue form works
- Replaced HTMX post with JS fetch (handleNewIssue)
- Adds CSRF token to form submission
- Reloads page on successful creation
- Cleaner error handling
bruno