feat(js): harden global HTTP and module import contracts

web/js/components/app-theme-toggle.js

@@ -2,6 +2,7 @@
  * Theme switcher — light/dark toggle and menu with server-side persistence.
  */
 import { warnOnce, resolveHost } from '../core/app-dom.js';
+import { postForm } from '../core/app-http.js';
 
 const setTheme = (theme) => {
   document.documentElement.dataset.theme = theme;
@@ -24,17 +25,12 @@ const updateTheme = async (source, theme) => {
   if (!url || !csrfKey || !csrfToken) {
     return true;
   }
-  const body = new URLSearchParams({ theme, [csrfKey]: csrfToken });
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-      'Accept': 'application/json',
-      'X-Requested-With': 'fetch',
-    },
-    body,
-  });
-  return response.ok;
+  try {
+    await postForm(url, { theme, [csrfKey]: csrfToken });
+    return true;
+  } catch {
+    return false;
+  }
 };
 
 export function initThemeControls(root = document, options = {}) {