- base.html: inject CSRF token into HTMX hx-headers via inline script - htmx:configRequest event updates CSRF on every request - HTMX loaded synchronously (no defer) so config runs before body parsed - Notes save now works, issue creation works, all POST protected