fix: manage/private-results 403 — CSRF origin check on read-only GETs

_origin_ok requires an Origin header, but browsers omit it on same-origin GET requests. Applying it to GET /api/manage and GET /api/private-results therefore rejected our own page with 403, so the manage panel never loaded.

The origin check is a CSRF guard and belongs on state-changing requests only; it still applies to POST /api/model/delete and /api/model/rerun. The reads remain session-gated and owner-gated, and a cross-origin caller cannot read the response because no CORS headers are served.

app.py

@@ -227,15 +227,20 @@ def logout(request: Request):
     return RedirectResponse("/", status_code=302)
 
 
-def _require_owner(request: Request) -> str:
+def _require_owner(request: Request, check_origin: bool = True) -> str:
     """Every management route funnels through here. The identity comes from the
-    signed session, so a crafted POST cannot impersonate the owner."""
+    signed session, so a crafted request cannot impersonate the owner.
+
+    check_origin is the CSRF guard and applies to STATE-CHANGING requests only.
+    Browsers omit the Origin header on same-origin GETs, so enforcing it on a read
+    endpoint rejects our own page. Reads are still session-gated, and a cross-origin
+    read cannot see the response anyway (no CORS headers are served)."""
     user = request.session.get("user")
     if not user:
         raise HTTPException(401, "Please sign in with Hugging Face.")
     if user != LEADERBOARD_OWNER:
         raise HTTPException(403, "Only the leaderboard maintainer can manage models.")
-    if not _origin_ok(request):
+    if check_origin and not _origin_ok(request):
         raise HTTPException(403, "Request blocked (bad origin).")
     if not HF_TOKEN:
         raise HTTPException(503, "The Space has no write token configured.")
@@ -254,7 +259,7 @@ class ModelRef(BaseModel):
 @app.get("/api/manage")
 def manage(request: Request):
     """Every request + whether a public/private score exists. Owner-only."""
-    _require_owner(request)
+    _require_owner(request, check_origin=False)   # read-only GET
     api = HfApi(token=HF_TOKEN)
     have = {}
     for repo, key in ((RESULTS_REPO, "public"), (RESULTS_PRIVATE_REPO, "private")):
@@ -340,7 +345,7 @@ def model_rerun(request: Request, body: ModelRef):
 def private_results(request: Request):
     """The private scores, served only to the owner. The browser cannot read that
     dataset directly, so this endpoint is the only way they reach the board."""
-    _require_owner(request)
+    _require_owner(request, check_origin=False)   # read-only GET
     api = HfApi(token=HF_TOKEN)
     out = []
     try: