Reduce the amount of POST requests

[HugoFara]

Those are legacy, API endpoint should be preferred.

[HugoFara]

Substantially done. Four of the 24 same-origin form POSTs are now on /api/v1:

• tag create/edit → POST/PUT /tags/{type} (9ca56cc57)
• profile, password change, preferences → PUT /profile* (152decb22)

Those were the user-facing ones. Closing rather than converting the other 20, which fall into three groups:

• Admin (settings, backup, wizard, install-demo) — admin-only, desktop, all behind ADMIN_MIDDLEWARE + CSRF.
• Feed wizard (4 steps) — stateful server-side flow; converting means moving wizard state to the client for no benefit.
• File uploads (book import, text edit/check/archived, vocabulary upload) and the OAuth link confirmation — multipart, and imports are explicitly out of the frontend-decoupling phase in ROADMAP.md ("fine in a WebView online").

A form POST only blocks the configurable API base URL if the page needs to work against a remote server. None of these do.

One exception worth doing separately, for a security reason rather than an API-consistency one: POST /word/new reads WoLgID straight from the request. The primitive it feeds is now gated (32c864596), but converting the form would remove the unvalidated input path entirely. Tracked separately.