test(e2e): send CSRF token on mutating requests and fix PAT UI selectors

The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.

- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
  header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
  Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
  'Create API token' (t('CreateApiToken')), not 'Create'.

Verified 8/8 passing across repeated CI-mode runs against a real backend.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

tests/e2e/cron-csrf.spec.ts

@@ -1,9 +1,10 @@
 import { expect } from "@playwright/test"
 
-import { test } from "./fixtures"
+import { csrfHeaders, test } from "./fixtures"
 
 test("manual cron trigger goes through POST, not GET", async ({ adminPage: page }) => {
     const created = await page.request.post("/api/v1/cron", {
+        headers: await csrfHeaders(page),
         data: {
             name: "e2e-cron-csrf",
             task_type: 0,
@@ -28,11 +29,16 @@ test("manual cron trigger goes through POST, not GET", async ({ adminPage: page
             `GET must no longer be routable (got ${getResp.status()})`,
         ).toBeTruthy()
 
-        const postResp = await page.request.post(`/api/v1/cron/${cronID}/manual`)
+        const postResp = await page.request.post(`/api/v1/cron/${cronID}/manual`, {
+            headers: await csrfHeaders(page),
+        })
         expect(postResp.ok(), `POST must succeed (got ${postResp.status()})`).toBeTruthy()
         const body = await postResp.json()
         expect(body.success).toBe(true)
     } finally {
-        await page.request.post("/api/v1/batch-delete/cron", { data: [cronID] })
+        await page.request.post("/api/v1/batch-delete/cron", {
+            headers: await csrfHeaders(page),
+            data: [cronID],
+        })
     }
 })