refactor(confighttp): HTML page handlers into generic getPage function (#4645)

docs/api.md

@@ -5,10 +5,38 @@ Sunshine has a RESTful API which can be used to interact with the service.
 Unless otherwise specified, authentication is required for all API calls. You can authenticate using
 basic authentication with the admin username and password.
 
+## CSRF Protection
+
+State-changing API endpoints (POST, DELETE) are protected against Cross-Site Request Forgery (CSRF) attacks.
+
+**For Web Browsers:**
+- Requests from same-origin (configured via `csrf_allowed_origins`) are automatically allowed
+- Cross-origin requests require a CSRF token
+
+**For Non-Browser Applications:**
+- Non-browser clients (e.g. `curl`, scripts, custom apps) are **exempt** from CSRF protection
+- CSRF attacks require a browser to silently attach credentials to a cross-origin request — this threat
+  does not apply to non-browser clients that explicitly provide credentials with every request
+- Requests with no `Origin` or `Referer` header (as is typical for non-browser clients) are automatically
+  allowed without a CSRF token
+
+**Example (browser-equivalent cross-origin request):**
+```bash
+# Get CSRF token
+curl -u user:pass https://localhost:47990/api/csrf-token
+
+# Use token in request
+curl -u user:pass -H "X-CSRF-Token: your_token_here" \
+  -X POST https://localhost:47990/api/restart
+```
+
 @htmlonly
 <script src="api.js"></script>
 @endhtmlonly
 
+## GET /api/csrf-token
+@copydoc confighttp::getCSRFToken()
+
 ## GET /api/apps
 @copydoc confighttp::getApps()