Mark IO proxy endpoint as CSRF-exempt (read-only, no state mutation)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/pages.py

@@ -563,6 +563,9 @@ def mount_io_endpoint(app: Any, service_name: str) -> None:
         if isinstance(_val, _Comp) and _val.io_refs:
             _ALLOWED_IO.update(_val.io_refs)
 
+    from shared.browser.app.csrf import csrf_exempt
+
+    @csrf_exempt
     async def io_proxy(name: str) -> Any:
         if name not in _ALLOWED_IO:
             quart_abort(403)