test(e2e): send CSRF token on mutating requests and fix PAT UI selectors

The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.

- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
  header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
  Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
  'Create API token' (t('CreateApiToken')), not 'Create'.

Verified 8/8 passing across repeated CI-mode runs against a real backend.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

tests/e2e/auth.spec.ts

@@ -1,6 +1,6 @@
 import { expect } from "@playwright/test"
 
-import { defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
+import { csrfHeaders, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
 
 test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
     await loginAs(page, defaultAdmin)
@@ -18,6 +18,7 @@ test("password change rotates TokenVersion and revokes existing session", async
     let isOnNewPassword = false
     try {
         const resp = await page.request.post("/api/v1/profile", {
+            headers: await csrfHeaders(page),
             data: {
                 original_password: defaultAdmin.password,
                 new_password: newPassword,
@@ -44,6 +45,7 @@ test("password change rotates TokenVersion and revokes existing session", async
             await page.context().clearCookies()
             await loginAs(page, { username: defaultAdmin.username, password: newPassword })
             const restoreResp = await page.request.post("/api/v1/profile", {
+                headers: await csrfHeaders(page),
                 data: {
                     original_password: newPassword,
                     new_password: defaultAdmin.password,