fix: remove all CSRF token usage from frontend API calls

- Route playlist save/load through /api/autodj/{mount}/playlist/save|load
  instead of legacy /admin/player/* form endpoints
- Remove last CSRF token references from Studio.tsx
- All frontend API calls now go through /api/* with Content-Type: application/json

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: syso