M4 §3/6: explain why the curl exercises need #[NoCSRFRequired] but the Vue frontend doesn't

From beta feedback by @yard-mschwartz (2026-08-10 batch).

The curl commands fail without #[NoCSRFRequired]. If I understand the tutorial correctly, this attribute is not needed once we've set up the Vue templates for managing pins. This keeps being a thing throughout the tutorial, e.g. when the DELETE endpoint is introduced later on.

PHP Track > M4 Database Layer > Section 3/6, Exercise — and it recurs wherever the reader is told to exercise an endpoint with curl, including the DELETE endpoint introduced later.

His reading is correct. @nextcloud/axios attaches the CSRF token for requests made from the frontend, so once the Vue frontend is doing the calls the attribute genuinely isn't needed. The problem is purely that the course never says this, so a reader following the curl steps hits a failure the text doesn't predict, and then has no way to know whether the attribute they added to make it work should stay or go.

Fix, roughly:

• At the first curl exercise, state that curl sends no CSRF token, so the endpoint needs #[NoCSRFRequired] for the manual-testing step.
• Say explicitly that this is temporary scaffolding, and that once the Vue frontend calls the endpoint via @nextcloud/axios the token comes along automatically and the attribute can come off.
• Make sure the module that introduces the frontend actually closes the loop and tells the reader to remove it, rather than leaving it silently in place.
• Apply the same treatment at the later DELETE endpoint rather than repeating the surprise.

Worth being careful with the wording: #[NoCSRFRequired] genuinely weakens protection, so the course shouldn't leave readers with the impression it's a routine annotation to sprinkle on endpoints.

Start in PHP Track > M4 Database Layer > Section 3/6, then find the later DELETE endpoint exercise and the module introducing the Vue frontend. Review how the curl steps describe #[NoCSRFRequired] and how @nextcloud/axios supplies CSRF tokens. Done means the tutorial explains the temporary manual-testing exception, tells readers to remove it for frontend calls, and applies the explanation to DELETE.