v2.1.1

Fixed

• Security: Hardened the local API server's CSRF protection by shifting from a fail-open to a fail-closed architecture. The /api/download and /api/batch-generate endpoints now explicitly reject requests that omit Origin or Referer headers.