Fix CSRF token in schema_apply request

Include csrf_token in POST body for schema_apply API call.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

webapp/settings.php

@@ -1320,7 +1320,8 @@ async function applySchemaUpdates() {
             headers: {
                 "Content-Type": "application/json",
                 "X-CSRF-Token": CSRF_TOKEN
-            }
+            },
+            body: JSON.stringify({ csrf_token: CSRF_TOKEN })
         });
         const data = await response.json();