fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取

SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/routes/apikeys.py

@@ -171,6 +171,6 @@ def setup_routes(app, prefix=""):
             return web.json_response({"error": str(e)}, status=500)
 
     app.router.add_get(f"{prefix}/api/apikeys", panel_auth(list_keys))
-    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key, csrf_protect=True))
-    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key, csrf_protect=True))
+    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key))
+    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key))
     logger.info(f"🔑 API Key 管理路由已注册 ({prefix}/api/apikeys)")