fix(tests): chat thread-settings test uses runner csrf helper

Was pulling CSRF from a meta tag that doesn't exist; the POST landed
without a valid token and the server dropped it before the plugin
handler could reply. Use the imported csrf() helper like the rest of
the suite does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

public/plugins/tests/chat.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, click, $, sleep, waitFor } from './runner.js?v=4';
+import { describe, it, expect, click, $, sleep, waitFor, csrf } from './runner.js?v=4';
 
 // Chat plugin tests — UI-focused. No send/receive here: that would
 // require a real relay, and the user's "no mocks" rule means we don't
@@ -120,19 +120,15 @@ describe('Chat: API', () => {
 
     it('/api/chat/thread-settings round-trips disposable flag', async () => {
         const peer = '__test_disposable_flip__';
-        // Default: 0
         const initial = await fetch('api/chat/thread-settings?peer=' + encodeURIComponent(peer))
             .then(r => r.json());
         expect(initial.disposable).toBe(0);
-        // Set to 1
-        const csrf = document.querySelector('meta[name="csrf"]')?.content || '';
         const set = await fetch('api/chat/thread-settings', {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
+            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
             body: JSON.stringify({ peer, disposable: true }),
         }).then(r => r.json());
         expect(set.disposable).toBe(1);
-        // Verify
         const after = await fetch('api/chat/thread-settings?peer=' + encodeURIComponent(peer))
             .then(r => r.json());
         expect(after.disposable).toBe(1);