pydantic-ai 2.28.0 · web UI CSRF fix

High-severity fix for Agent.to_web() / clai web: the chat endpoint ignored content type, so a cross-origin page in the developer's browser could trigger the local agent and its tools without a CORS preflight. Now requires Content-Type: application/json. Patched in 2.28.0 and 1.107.3.⁴

Relevant to: anyone who runs the pydantic-ai dev web chat on a workstation