What's new in 2.10.13

Silent CSRF renewal and request recovery.

The core added _gestor-csrf-token to obtain a renewed token. Global JavaScript recognizes CSRF_INVALID_OR_EXPIRED, renews the token, and retries the request across fetch, jQuery.ajax, and XMLHttpRequest. It also checks the token proactively when a tab becomes visible again. The endpoint and retry operate in the user's session context.

Verified against the code at commit ad58064f