fix(today-settings): add missing CSRF token to today settings PUT request (#1044)

TodaySettingsDropdown was the only settings component that omitted the
x-csrf-token header, causing PUT /api/profile/today-settings to return
500 for all session-authenticated users.

Adds integration tests for the today-settings endpoint.

frontend/components/Task/TodaySettingsDropdown.tsx

@@ -1,4 +1,5 @@
 import React, { useState, useEffect, useRef } from 'react';
+import { getCsrfToken } from '../../utils/csrfService';
 import { useTranslation } from 'react-i18next';
 import {
     ChartBarIcon,
@@ -86,6 +87,7 @@ const TodaySettingsDropdown: React.FC<TodaySettingsDropdownProps> = ({
                 credentials: 'include',
                 headers: {
                     'Content-Type': 'application/json',
+                    'x-csrf-token': await getCsrfToken(),
                 },
                 body: JSON.stringify(settingsToSave),
             });