fix: use POST for delete instead of DELETE method (CSRF compatibility)

Author: Codex

internal/web/handlers/server.go

@@ -78,7 +78,7 @@ func NewServer(cfg web.Config, db *sql.DB) *http.Server {
 
 			r.Post("/items/{id}/reclassify", ReclassifyItemHandler(cfg, db))
 			r.Post("/items/{id}", UpdateItemHandler(db))
-			r.Delete("/items/{id}", DeleteItemHandler(db))
+			r.Post("/items/{id}/delete", DeleteItemHandler(db))
 			r.Get("/items/{id}/edit", EditItemForm(db))
 			r.Post("/generate", GenerateReport(cfg, db))
 			r.Get("/generate/{jobID}/status", GenerateStatus())

internal/web/templates/item_row.templ

@@ -75,9 +75,9 @@ templ ItemRow(item ItemData, allSections []SectionData, isManager bool) {
 					title="Edit"
 				>&#9998;</button>
 				<button
-					hx-delete={ fmt.Sprintf("/items/%d", item.ID) }
+					hx-post={ fmt.Sprintf("/items/%d/delete", item.ID) }
 					hx-target={ fmt.Sprintf("#item-%d", item.ID) }
-					hx-swap="outerHTML"
+					hx-swap="delete"
 					hx-confirm="Delete this item?"
 					title="Delete"
 				>&times;</button>