Fix CSRF token and currentUser references in api.js

- Use state.csrfToken instead of undefined csrfToken in handleLogout
- Use state.currentUser instead of undefined currentUser in handleLogout
- Use state.csrfToken instead of undefined csrfToken in enableSonarrWebhook
- Fixes ReferenceError bugs in logout and webhook functions

client/src/api.js

@@ -57,10 +57,10 @@ export async function handleLogout() {
   try {
     await fetch('/api/auth/logout', {
       method: 'POST',
-      headers: csrfToken ? { 'X-CSRF-Token': csrfToken } : {}
+      headers: state.csrfToken ? { 'X-CSRF-Token': state.csrfToken } : {}
     });
-    currentUser = null;
-    csrfToken = null;
+    state.currentUser = null;
+    state.csrfToken = null;
     return { success: true };
   } catch (err) {
     console.error('Logout failed:', err);
@@ -203,7 +203,7 @@ export async function enableSonarrWebhook() {
   try {
     const res = await fetch('/api/sonarr/notifications/sofarr-webhook', {
       method: 'POST',
-      headers: { 'X-CSRF-Token': csrfToken || '' }
+      headers: { 'X-CSRF-Token': state.csrfToken || '' }
     });
     if (!res.ok) throw new Error('Failed to enable');
     await fetchWebhookStatus();