UPLOAD SECURITY TOKEN FIX
==========================

Fixed the Admin Setup/PDF upload flow so its XMLHttpRequest now obtains the current
session CSRF token from /api/security/csrf and sends it as X-CSRF-Token.

The upload retries once with a freshly fetched token if the server returns HTTP 419.
Same-origin credentials are explicitly enabled and cache-busting was added to the
frontend entry/module URLs so the browser loads the fixed upload code.

The server-side CSRF guard remains enabled; it was not disabled as a workaround.
