fix(modtools): add client-side CSRF token validation for CSV upload

Add explicit CSRF token check before sending the upload request, and
handle 403 responses with a user-friendly message suggesting a page
refresh. Complements the server-side @ensure_csrf_cookie fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dcschreiber

static/js/modtools/components/BulkUploadCSV.jsx

@@ -94,15 +94,28 @@ function BulkUploadCSV() {
     }
 
     try {
+      const csrfToken = Cookies.get('csrftoken');
+      if (!csrfToken) {
+        setUploadError("Error - CSRF token not found. Try refreshing the page.");
+        setUploading(false);
+        return;
+      }
+
       const response = await fetch('/api/text-upload', {
         method: 'POST',
         headers: {
-          'X-CSRFToken': Cookies.get('csrftoken')
+          'X-CSRFToken': csrfToken
         },
         credentials: 'same-origin',
         body: formData
       });
 
+      if (response.status === 403) {
+        setUploadError("Error - Permission denied (403). Try refreshing the page to get a new CSRF token.");
+        setUploading(false);
+        return;
+      }
+
       const data = await response.json();
 
       if (data.status === "ok") {