do stuffs

frontend/src/api.ts

@@ -1,16 +1,26 @@
 import { AuthStatusRequest, AuthStatusResponse } from "../items";
 
+export const getCsrfToken = (): string | null => {
+  const match = document.cookie.match(/csrf_token=([^;]+)/);
+  return match ? decodeURIComponent(match[1]) : null;
+};
+
 export const apiFetch = async (
   url: string,
   options: RequestInit = {}
 ): Promise<Response> => {
   const token = localStorage.getItem("token");
+  const csrfToken = getCsrfToken();
   const headers = new Headers(options.headers);
 
   if (token) {
     headers.set("Authorization", `Bearer ${token}`);
   }
 
+  if (csrfToken) {
+    headers.set("X-CSRF-Token", csrfToken);
+  }
+
   const config = {
     ...options,
     headers,