test(e2e): fix revoke empty-list crash and password-restore CSRF cascade

Two CI-only failures surfaced against a fresh backend DB:

- The revoke test read after.data.find(), but the list endpoint omits data
  entirely when the admin has zero tokens, throwing on undefined. Default to [].
- The password-change test's restore POST hit a 403: changing the password
  triggers a refresh-token that re-mints the nz-csrf cookie, so the X-CSRF-Token
  read just before the request can be stale. A failed restore left the admin on
  the rotated password and cascaded into cron/fm/visibility login failures.
  Add csrfRequest(), which retries once on 403 after re-reading the cookie, and
  use it for both profile mutations.

Verified 8/8 passing across repeated fresh-DB CI-mode runs.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

tests/e2e/api-tokens.spec.ts

@@ -58,8 +58,11 @@ test("admin can revoke an API token via UI revoke button", async ({ page }) => {
 
     await expect(row).toHaveCount(0)
 
+    // The list endpoint omits `data` entirely when the admin has zero tokens,
+    // so default to [] before searching for the revoked id.
     const after = await page.request.get("/api/v1/api-tokens").then((r) => r.json())
-    expect(after.data.find((t: { id: number }) => t.id === tokenID)).toBeUndefined()
+    const tokens: Array<{ id: number }> = after.data ?? []
+    expect(tokens.find((t) => t.id === tokenID)).toBeUndefined()
 })
 
 test("an API token can authenticate /mcp", async ({ page }) => {