feat(api-tokens): add PAT management UI, CSRF handling, and auth-loading fixes

Add an API tokens management route to create, list, and revoke PATs, showing
the plaintext token once on creation with scope and server-id selection.

Mirror the nz-csrf cookie into the X-CSRF-Token header on unsafe fetcher
methods (POST/PUT/PATCH/DELETE) for the server-side double-submit check, and
self-heal expired sessions via refresh-token without a recursive fetch loop.

Gate protected routes behind resolved auth state to avoid pre-auth SWR fetches,
and fix the login loading/race so stale probes cannot clobber the session.

Add i18n keys for the new screens across all locales.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

vite.config.ts

@@ -6,6 +6,10 @@ export default defineConfig({
     base: "/dashboard",
     plugins: [react()],
     server: {
+        // Bind the dev server to loopback so an in-browser CSRF or LAN
+        // scan cannot reach a developer's dashboard token. Override with
+        // `bun run dev -- --host 0.0.0.0` for Docker / remote dev only.
+        host: "127.0.0.1",
         proxy: {
             "^/api/v1/ws/.*": {
                 target: "ws://127.0.0.1:8008",
@@ -16,6 +20,10 @@ export default defineConfig({
                 target: "http://127.0.0.1:8008",
                 changeOrigin: true,
             },
+            "/mcp": {
+                target: "http://127.0.0.1:8008",
+                changeOrigin: true,
+            },
         },
     },
     resolve: {