fix(fm): switch create FM session to POST to defeat CSRF

GET /api/v1/file?id=<server> created an FM stream on the agent stream
and committed real state change (TaskTypeFM dispatched). With JWT
cookie SameSite=Lax a victim's browser would still send the cookie on
a top-level cross-site GET, so an attacker could trick a logged-in
user into opening an FM session on any of their own servers, consuming
resources and triggering the agent's FM machinery without consent.

Mirror the GHSA-8qhj-4f8c-j8qg fix: move the route to POST. SameSite=
Lax cookies are not sent on cross-site POST. Frontend (admin-frontend)
adjusted in a follow-up commit.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/controller.go

@@ -84,7 +84,7 @@ func routers(r *gin.Engine, frontendDist fs.FS) {
 	auth.POST("/terminal", commonHandler(createTerminal))
 	auth.GET("/ws/terminal/:id", commonHandler(terminalStream))
 
-	auth.GET("/file", commonHandler(createFM))
+	auth.POST("/file", commonHandler(createFM))
 	auth.GET("/ws/file/:id", commonHandler(fmStream))
 
 	auth.GET("/profile", commonHandler(getProfile))