fix(yabeda): Use ActionController::API in yabeda-mini app

The app is configured as api_only but inherited from ActionController::Base,
which includes CSRF protection middleware. Switch to ActionController::API
to align with the api_only setting and eliminate the CSRF warning.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dingsdax

spec/apps/yabeda-mini/app.rb

@@ -100,7 +100,7 @@ class Post < ActiveRecord::Base
 end
 
 # Controllers
-class ApplicationController < ActionController::Base
+class ApplicationController < ActionController::API
   around_action :track_metrics
 
   private