- CSRF token now uses \App\Core\CSRF::token() to ensure it's always
  generated, not raw $_SESSION which could be empty
- apiPost and loadState now check response.ok before parsing JSON,
  preventing silent failures when server returns 419/500/HTML
- Error messages now include status code or exception details
- Added guard for empty SLOTS array (missing operating hours)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>