fix: add CSRF token to read/unread toggle AJAX request

Resolves CSRF validation error when toggling read status from overview page.
The detail page was working correctly because it included the token via
form serialization, but the overview page implementation was missing it.

Author: crocodilestick

CONTRIBUTORS

@@ -312,7 +312,7 @@ Copyright (C) 2024-2026 Calibre-Web Automated contributors
 - zhiyue (1 commits)
 # Fork Contributors (crocodilestick/calibre-web-automated)
 
-- crocodilestick (900 commits)
+- crocodilestick (909 commits)
 - jmarmstrong1207 (73 commits)
 - demitrix (30 commits)
 - sirwolfgang (29 commits)

cps/static/js/caliBlur.js

@@ -1060,6 +1060,9 @@ $(function() {
         $.ajax({
             url: window.scriptRoot + '/ajax/toggleread/' + bookId,
             type: 'POST',
+            data: {
+                csrf_token: $("input[name='csrf_token']").val()
+            },
             headers: {
                 'X-Requested-With': 'XMLHttpRequest'
             },