fix(#351): CSRF-403 bei KI-Chat und Wiki-Save behoben — /auth/me liefert csrf_token, streamChat nutzt gemeinsamen Client-Token statt totem sessionStorage-Key; Regressionstests pytest+vitest

frontend/src/api/ai.ts

@@ -5,7 +5,7 @@
  * AI Assistant plugin routes under `/ai/...`.
  */
 
-import { apiDelete, apiGet, apiPost, apiPut } from './client';
+import { apiDelete, apiGet, apiPost, apiPut, getCsrfToken } from './client';
 
 // ─── Types ───
 
@@ -126,7 +126,7 @@ export async function* streamChat(
   content: string,
   agentId?: string
 ): AsyncGenerator<StreamEvent> {
-  const csrfToken = sessionStorage.getItem('leocrm_csrf_token');
+  const csrfToken = getCsrfToken();
   const response = await fetch(`/api/v1/ai/conversations/${conversationId}/stream`, {
     method: 'POST',
     headers: {

frontend/src/api/auth.ts

@@ -70,6 +70,10 @@ export function useCurrentUser() {
     queryKey: ['currentUser'],
     queryFn: async () => {
       const data = await apiGet<any>('/auth/me');
+      // Restore CSRF token after page reload — /auth/me returns it from the session
+      if (data.csrf_token) {
+        setCsrfToken(data.csrf_token);
+      }
       setUser(data.user || data);
       setAuthenticated(true);
       return data;