fix(web): include CSRF token on login + logout fetch

Sanctum's statefulApi() runs same-origin API requests through the
web middleware stack, which enforces CSRF. Send X-CSRF-TOKEN from the
meta tag and credentials: same-origin so cookies travel with the
request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

resources/views/auth/login.blade.php

@@ -164,11 +164,15 @@
         };
 
         try {
+            const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? '';
             const res = await fetch('/api/v1/auth/login', {
                 method: 'POST',
+                credentials: 'same-origin',
                 headers: {
                     'Content-Type': 'application/json',
                     'Accept': 'application/json',
+                    'X-CSRF-TOKEN': csrf,
+                    'X-Requested-With': 'XMLHttpRequest',
                 },
                 body: JSON.stringify(payload),
             });

resources/views/dashboard.blade.php

@@ -91,9 +91,16 @@
 
     document.getElementById('logout-btn').addEventListener('click', async () => {
         try {
+            const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? '';
             await fetch('/api/v1/auth/logout', {
                 method: 'POST',
-                headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' },
+                credentials: 'same-origin',
+                headers: {
+                    'Authorization': `Bearer ${token}`,
+                    'Accept': 'application/json',
+                    'X-CSRF-TOKEN': csrf,
+                    'X-Requested-With': 'XMLHttpRequest',
+                },
             });
         } catch {}
         localStorage.removeItem('verde:token');