Fixes#1064
Admin user operations (create, update, delete, toggle registration) were
failing with "CSRF token missing" error when accessed behind a reverse proxy.
This happened because the frontend was using plain fetch() instead of
fetchWithCsrf() utility which automatically includes the CSRF token header.
Changed all state-changing operations in AdminUsersPage to use fetchWithCsrf:
- createAdminUser (POST /admin/users)
- updateAdminUser (PUT /admin/users/:id)
- deleteAdminUser (DELETE /admin/users/:id)
- toggleRegistration (POST /admin/toggle-registration)