fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取

SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token

Co-Authored-By: Claude <noreply@anthropic.com>

config/permissions/pending_requests.json

@@ -196,5 +196,27 @@
       "framework.command.execute"
     ],
     "timestamp": 26822.157063829
+  },
+  "bf684985": {
+    "plugin_name": "example_plugin",
+    "permissions": [
+      "plugin.example.read",
+      "plugin.example.write",
+      "plugin.example.execute",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.600966307
+  },
+  "30f30786": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.605505473
   }
 }

config/plugins/commands.yaml

@@ -101,7 +101,7 @@ commands:
     permissions:
     - framework.command.test
     source: internal
-last_updated: 26822.134496381
+last_updated: 27154.562528494
 plugin_commands:
   example_plugin:
     echo: *id001

config/services/network_routes.yaml

@@ -1,5 +1,5 @@
 http_port: 4200
-last_updated: 26822.153658933
+last_updated: 27154.60330813
 plugin_routes:
   example_plugin:
   - methods:

services/web_panel/routes/apikeys.py

@@ -171,6 +171,6 @@ def setup_routes(app, prefix=""):
             return web.json_response({"error": str(e)}, status=500)
 
     app.router.add_get(f"{prefix}/api/apikeys", panel_auth(list_keys))
-    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key, csrf_protect=True))
-    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key, csrf_protect=True))
+    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key))
+    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key))
     logger.info(f"🔑 API Key 管理路由已注册 ({prefix}/api/apikeys)")