Unauthorized runSSE requests when XSRF protection enabled

## Behaviour

Requests to `POST /run_sse` from the ADK web UI fail with HTTP status 401 Unauthorized if the ADK API has XSRF protection enabled.

From my observation, this only affects the SSE request; other requests such as create session do succeed.

## Root cause

`X-XSRF-TOKEN` header not added to `/run_sse` fetch [request](https://github.com/google/adk-web/blob/49bf31c8fb1e56f1eab36652e5cd310236fecf49/src/app/core/services/agent.service.ts#L63).

Note: Other requests succeed because they use `HttpClient` from `'@angular/common/http'` which automatically enables XSRF protection (see [withNoXsrfProtection](https://v17.angular.io/api/common/http/withNoXsrfProtection)). The SSE request uses `fetch`, I guess because it needs to stream the SSE response body.

Start in src/app/core/services/agent.service.ts at the /run_sse fetch request and compare it with the Angular HttpClient requests that succeed under XSRF protection. Verify the POST /run_sse request includes the expected XSRF token and confirm that the ADK web UI receives a successful SSE response when API XSRF protection is enabled.

Written by the indexing model from the issue text.