library: staff signed in to Koha open Add books without a second login

Quick Add asks Koha (C4::Auth::check_cookie_auth via a secret-guarded svc script) whether the
browser's session may edit the catalogue; falls back to its own login otherwise. Cookie-authenticated
writes need an X-Quickadd header; the direct port never accepts cookies.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/quickadd/index.html

@@ -211,8 +211,10 @@
   };
 
   async function api(path, body) {
-    const r = await fetch(path.replace(/^\//, ''), body ? { method: 'POST', headers: { 'Content-Type': 'application/json' },
-                                         body: JSON.stringify(body) } : {});
+    // X-Quickadd marks our own requests: a staff-site login (cookie) is only accepted for changes
+    // that carry it, which a page on another website cannot add (cross-site request forgery).
+    const r = await fetch(path.replace(/^\//, ''), body ? { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Quickadd': '1' },
+                                         body: JSON.stringify(body) } : { headers: { 'X-Quickadd': '1' } });
     return r.json();
   }
 
@@ -329,7 +331,7 @@
         $('status').textContent = 'Reading the barcode…';
         try {
           const blob = await shrink(f);
-          const r = await fetch('api/scan?kind=' + kind, { method: 'POST', headers: { 'Content-Type': 'image/jpeg' }, body: blob });
+          const r = await fetch('api/scan?kind=' + kind, { method: 'POST', headers: { 'Content-Type': 'image/jpeg', 'X-Quickadd': '1' }, body: blob });
           resolve(r.ok ? (await r.json()).codes : []);
         } catch (e) { resolve([]); }
       };