hardening: require POST + CSRF token for purge_syslog_hosts utility action

[somethingwithproof]

Summary

purge_syslog_hosts is currently triggered by a GET link and performs destructive DELETE operations.

Evidence

• Trigger link: setup.php:1621 (utilities.php?action=purge_syslog_hosts)
• Destructive path: setup.php:1568-1604 (multiple DELETE statements)
• Core GET guard only blocks specific actions (save, update_data, changepassword), so this path can still be GET-triggered.

Risk

Authenticated admin users can be induced to trigger data-destructive actions via crafted links/embedded requests.

Expected fix

• Require POST for purge_syslog_hosts
• Require and validate __csrf_magic
• Keep/extend explicit confirmation UX prior to executing deletes

[somethingwithproof]

Confirmed unresolved on current develop: the utility still performs the purge from a GET action. PR #318 changes it to a confirmed POST, checks CSRF server-side, and currently has green integration checks. Keep open until #318 is merged.