fix: mail plugin CSRF token handling and trailing slash

- Add CSRF token storage in sessionStorage (persists across reloads)
- Send X-CSRF-Token header on POST/PATCH/DELETE requests
- Store CSRF token on login, clear on logout
- Fix trailing slash in mail list API call (/mail/ -> /mail)

frontend/src/api/client.ts

@@ -15,6 +15,23 @@ export const apiClient = axios.create({
   },
 });
 
+// CSRF token storage — persisted in sessionStorage, sent on all unsafe methods
+const CSRF_KEY = 'leocrm_csrf_token';
+let csrfToken: string | null = sessionStorage.getItem(CSRF_KEY);
+
+export function setCsrfToken(token: string | null) {
+  csrfToken = token;
+  if (token) {
+    sessionStorage.setItem(CSRF_KEY, token);
+  } else {
+    sessionStorage.removeItem(CSRF_KEY);
+  }
+}
+
+export function getCsrfToken(): string | null {
+  return csrfToken;
+}
+
 let onUnauthorized: (() => void) | null = null;
 let onValidationError: ((errors: Record<string, string[]>) => void) | null = null;
 
@@ -28,6 +45,11 @@ export function setValidationErrorHandler(handler: (errors: Record<string, strin
 
 apiClient.interceptors.request.use(
   (config: InternalAxiosRequestConfig) => {
+    // Attach CSRF token on unsafe methods
+    const unsafe = ['post', 'put', 'patch', 'delete'];
+    if (unsafe.includes(config.method?.toLowerCase() ?? '') && csrfToken) {
+      config.headers['X-CSRF-Token'] = csrfToken;
+    }
     return config;
   },
   (error) => Promise.reject(error)