fix(providers): pass through server CSRF reason instead of one-size message (review feedback from @nesquena-hermes)

CHANGELOG.md

@@ -5,7 +5,7 @@
 
 ### Changed
 
-- Removing a provider key now surfaces "Session expired. Reload the page and try again." when the underlying POST is rejected with 403, instead of the raw "Cross-origin request rejected" string that gives the user no next step. (Refs #2572)
+- Removing a provider key now surfaces the server's specific CSRF rejection reason ("Session expired - reload the page", "Cross-origin mismatch - check reverse proxy headers", or the fallback "Cross-origin request rejected") when the underlying POST is rejected with 403, instead of swallowing all three into one generic toast. (Refs #2572)
 
 ## [v0.51.137] — 2026-05-25 — Release DI (stage-batch19 — 6-PR medium-risk batch)
 

static/panels.js

@@ -6875,13 +6875,15 @@ async function _removeProviderKey(providerId){
     }
   }catch(e){
     // A 403 from /api/providers/delete fires when the CSRF cookie/header
-    // pair has drifted (typically a tab opened before the most recent
-    // login or cookie rotation). The raw server string is
-    // "Cross-origin request rejected" which reads like a deployment-shape
-    // problem and gives the user no next step (#2572). Surface a clearer
-    // recovery hint instead so reloading the page is an obvious fix.
+    // pair has drifted. The server distinguishes three reasons in
+    // api/routes.py:_csrf_rejection_error ("Session expired - reload the
+    // page", "Cross-origin mismatch - check reverse proxy headers", and
+    // the fallback "Cross-origin request rejected"); api()'s catch lifts
+    // that string onto e.message. Pass it through verbatim so the
+    // deployment-shape failure #2572 calls out keeps its actionable hint
+    // instead of being flattened to a single generic toast.
     if(e&&e.status===403){
-      showToast('Session expired. Reload the page and try again.',6000,'error');
+      showToast(e.message||'Session expired. Reload the page and try again.',6000,'error');
     }else{
       showToast('Error: '+e.message);
     }