fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取

SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token

Co-Authored-By: Claude <noreply@anthropic.com>

config/permissions/pending_requests.json

@@ -196,5 +196,27 @@
       "framework.command.execute"
     ],
     "timestamp": 26822.157063829
+  },
+  "bf684985": {
+    "plugin_name": "example_plugin",
+    "permissions": [
+      "plugin.example.read",
+      "plugin.example.write",
+      "plugin.example.execute",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.600966307
+  },
+  "30f30786": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.605505473
   }
 }